feat: drop the 2.8 columns, moves and aliases kept for a downgrade

docker/nginx-https.conf

@@ -291,33 +291,6 @@ http {
             proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
         }
 
-        # 2.8 URLs that something outside Termix still calls: the Vault OIDC
-        # callback, the Termix ID resolver and automation webhooks. The
-        # backend redirects each to the plugin that serves it now (see
-        # contributes.http in each plugin's manifest). New plugins never add
-        # a block here.
-        location = /vault/oidc/callback {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
-        }
-
-        location ^~ /termix-id/u/ {
-            proxy_pass http://127.0.0.1:30001;
-            proxy_http_version 1.1;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-        }
-
-        location ^~ /automations/webhook/ {
-            rewrite ^/automations/webhook/(.*)$ /plugin-api/automations/webhook/$1 last;
-        }
-
         # Every plugin's HTTP routes. One block, no per-plugin entries: a
         # plugin serves at /plugin-api/<id>/ on the main backend and never
         # gets a port or a block of its own. Buffering is off so SSE streams