chore(vocero): remove the legacy ApiPilot integration (#3)

Vocero now retrieves AquaPortal content through authenticated MCP. This removes the obsolete ApiPilot integration from the API and browser while preserving the separately deployed speech pipeline.

Release notes:

- Removed ApiPilot endpoints, configuration, credential overrides, and HTTP/realtime tool execution.
- Removed browser ApiPilot catalog loading and prompt generation while retaining authenticated MCP discovery.
- Updated regression coverage and operating documentation for the retired routes and settings.

Reviewed-on: AquaPortal/s2s#3

docs/client/usage.md

@@ -2,7 +2,8 @@
 
 The browser voice client connects to an existing OpenAI Realtime-compatible
 speech backend. The UI server can also proxy WebSocket traffic, search,
-reasoning, caller context, ApiPilot tools and load-balancer requests.
+reasoning, caller context, authenticated AquaPortal MCP tools and load-balancer
+requests.
 
 ## Local startup
 
@@ -126,8 +127,8 @@ translations.
 
 Web search needs `SERPER_API_KEY` on the server or a user-supplied key in the
 tools panel. The server proxies requests through `/api/search`; its own key is
-not returned to the browser. Dynamic ApiPilot tools are configured through
-`S2S_APIPILOT_TOOLS_URL`; see [tool calling](tool-calling.md).
+not returned to the browser. AquaPortal content tools use authenticated MCP;
+see [tool calling](tool-calling.md).
 
 Operator RAG text is applied through the RAG dialog and updates live
 instructions. Caller links may include `phoneNumber=%2B...`; episode links may
@@ -141,7 +142,7 @@ enabled data sources and limits.
 Streamable HTTP endpoint, for example `https://backend.example.test/api/v1/mcp/`.
 Set `S2S_LOGIN_BY_PHONE` to that backend's `POST /api/v1/auth/phone-login` URL.
 The phone parameter remains an identity selector without proof of ownership.
-MCP uses the returned opaque `sessionToken`, never an ApiPilot API key or service token.
+MCP uses the returned opaque `sessionToken` for that user, with no service-token override.
 
 For voice reasoning (`S2S_REASONING_TYPE=PROXY`), set `S2S_PROXY_TARGET` to the
 speech service and leave `SPEECH_TO_SPEECH_URL` and `LOAD_BALANCER_URL` unset.
@@ -153,10 +154,20 @@ or audio-format change is required.
 
 The backend must expose the eight-tool catalog and phone-login contract described
 in [tool calling](tool-calling.md#authenticated-aquaportal-mcp). Leave
-`S2S_MCP_URL` unset to retain the existing ApiPilot and caller-context paths.
+`S2S_MCP_URL` unset to use the existing caller-context paths without MCP tools.
 Setting it makes MCP the exclusive AquaPortal content path: legacy profile,
-report, latest-summary, and episode preloads are skipped. Existing ApiPilot
-and caller HTTP routes return 409 while MCP is enabled.
+report, latest-summary, and episode preloads are skipped. Legacy caller HTTP
+routes return 409 while MCP is enabled.
+
+ApiPilot has been retired. `/api/apipilot/tools` and `/api/apipilot/execute`
+return 404, and `/api/config` no longer includes `apipilot`. Remove obsolete
+`S2S_APIPILOT_TOOLS_URL`, `S2S_APIPILOT_TOOLS_EXECUTE_URL`,
+`S2S_APIPILOT_SERVICE_TOKEN`, `S2S_APIPILOT_API_KEY`, `S2S_APIPILOT_TTL_SEC`,
+and `S2S_APIPILOT_TIMEOUT_SEC` from deployment configuration; they are ignored.
+Keep `S2S_LOGIN_BY_PHONE`, which is still required for MCP authentication.
+Deploy the API and frontend together and refresh existing browser sessions.
+The separately deployed `speech_to_speech/` service is unchanged by this removal;
+its existing legacy marker sanitizers remain, with no speech restart required.
 
 | Setting | Default | Meaning |
 |---|---|---|