refactor: retire release acceptance API key leases

.github/scripts/test_model_context_capacity.sh

@@ -6,6 +6,6 @@ cd "$repo_root/backend"
 
 # Offline policy, persistence, and wire-contract fixtures only; no model calls.
 go test -p=1 -tags unit \
-  ./internal/service ./internal/repository ./internal/handler ./internal/handler/admin ./cmd/server \
-  -run 'Test.*(ModelContext|OfficialModelCatalog|ContextCapacit|GroupModelCapacity|CodexCapacityProjection|SyncUpstreamModelCatalog.*Capacity|RunCodexContextContractVerification)' \
+  ./internal/service ./internal/repository ./internal/handler ./internal/handler/admin \
+  -run 'Test.*(ModelContext|OfficialModelCatalog|ContextCapacit|GroupModelCapacity|CodexCapacityProjection|SyncUpstreamModelCatalog.*Capacity)' \
   -count=1

.github/workflows/downstream-verify.yml

@@ -55,7 +55,7 @@ jobs:
         working-directory: backend
         run: |
           go test -p=1 -tags unit ./internal/repository ./internal/service ./internal/handler ./internal/handler/admin -run 'Test.*(CodexImageGenerationBridgeOverridePrecedence|TurnStateCommits|SchedulerCache|GatewayModels|WriteOpenAIModelsList|AccountHandlerGetAvailableModels|ForwardResponsesOllamaClampPreservesContinuationPolicy|AccountAvailableModels|FetchOpenAIAccountModels|SetAnthropicAPIKeyAuthHeader|OllamaCloud.*(MaxTokens|MaxOutputTokens|Bearer)|Clamps.*OllamaBase)' -count=1
-          go test -p=1 -tags unit ./migrations -run 'Test.*(Migration222|Migration223|Migration224|Migration230|Migration231|Migration232|Migration235|Migration236|GroupModelAllowlistRepairMigration|ReleaseAcceptance)' -count=1
+          go test -p=1 -tags unit ./migrations -run 'Test.*(Migration222|Migration223|Migration224|Migration230|Migration231|Migration232|Migration235|Migration236|GroupModelAllowlistRepairMigration)' -count=1
       - name: Request body recovery tests
         working-directory: backend
         run: go test -p=1 ./internal/pkg/httputil ./internal/handler -run 'Test(ReadRequestBodyWithPrealloc|ReadLenientJSONRequestBodyWithPrealloc|RequestBodyReadDiagnostics|ClassifyRequestContentEncoding)' -count=1
@@ -71,7 +71,10 @@ jobs:
         run: go test -p=1 -tags unit ./internal/handler/admin -run '^TestAccountJobBulk.*$' -count=1
       - name: Account taxonomy migration integration test
         working-directory: backend
-        run: go test -p=1 -tags integration ./internal/repository -run '^Test(AccountTaxonomy.*|DeleteAccountFolder.*)Integration$|^TestAPIKeyRepoSuite$/^TestReleaseAcceptanceKeyIsAdminListedReadOnlyAndAuthenticates$' -count=1
+        run: go test -p=1 -tags integration ./internal/repository -run '^Test(AccountTaxonomy.*|DeleteAccountFolder.*)Integration$' -count=1
+      - name: Release acceptance retirement migration integration test
+        working-directory: backend
+        run: go test -p=1 -tags integration ./migrations -run '^TestMigration274RemovesReleaseAcceptanceKeysSafely$' -count=1
       - name: Repository audit integration tests
         working-directory: backend
         run: go test -p=1 -tags integration ./internal/repository -run '^Test(PGXBatchInsertAuditAndSystemLogs|Migration236.*)$' -count=1

backend/cmd/server/main.go

@@ -7,8 +7,6 @@ import (
 	_ "embed"
 	"errors"
 	"flag"
-	"fmt"
-	"io"
 	"log"
 	"net/http"
 	"os"
@@ -22,7 +20,6 @@ import (
 	"github.com/Wei-Shaw/sub2api/internal/handler"
 	"github.com/Wei-Shaw/sub2api/internal/pkg/logger"
 	"github.com/Wei-Shaw/sub2api/internal/server/middleware"
-	"github.com/Wei-Shaw/sub2api/internal/service"
 	"github.com/Wei-Shaw/sub2api/internal/setup"
 	"github.com/Wei-Shaw/sub2api/internal/web"
 
@@ -62,24 +59,7 @@ func main() {
 	// Parse command line flags
 	setupMode := flag.Bool("setup", false, "Run setup wizard in CLI mode")
 	showVersion := flag.Bool("version", false, "Show version information")
-	verifyCodexContextContract := flag.Bool(
-		"verify-codex-context-contract",
-		false,
-		"Verify ordinary-provider context capacity priority and protected-manifest contracts offline",
-	)
 	flag.Parse()
-	if *verifyCodexContextContract {
-		exitCode := runCodexContextContractVerification(
-			os.Stdout,
-			*setupMode,
-			*showVersion,
-			flag.Args(),
-		)
-		if exitCode != 0 {
-			os.Exit(exitCode)
-		}
-		return
-	}
 
 	if *showVersion {
 		log.Printf("Sub2API %s (commit: %s, built: %s)\n", Version, Commit, Date)
@@ -114,41 +94,6 @@ func main() {
 	runMainServer()
 }
 
-func runCodexContextContractVerification(
-	stdout io.Writer,
-	setupMode bool,
-	showVersion bool,
-	positionalArgs []string,
-) int {
-	return runCodexContextContractVerificationWith(
-		stdout,
-		setupMode,
-		showVersion,
-		positionalArgs,
-		service.VerifyOfficialCodexContextContract,
-	)
-}
-
-func runCodexContextContractVerificationWith(
-	stdout io.Writer,
-	setupMode bool,
-	showVersion bool,
-	positionalArgs []string,
-	verify func() (string, error),
-) int {
-	if setupMode || showVersion || len(positionalArgs) != 0 {
-		_, _ = fmt.Fprintln(stdout, service.OfficialCodexContextInvalidArgsLine)
-		return 2
-	}
-	line, err := verify()
-	if err != nil {
-		_, _ = fmt.Fprintln(stdout, service.OfficialCodexContextContractFailureLine)
-		return 1
-	}
-	_, _ = fmt.Fprintln(stdout, line)
-	return 0
-}
-
 func runSetupServer() {
 	r := gin.New()
 	r.Use(middleware.Recovery())