chore(agent): remove stale unscoped webhook routes from API router

`compliance-agent/src/api/routes.rs` mounted the pre-M7.2-C webhook
routes `/webhook/{platform}/{repo_id}` on the API server (port 3001),
but the handlers in `compliance-agent/src/webhooks/{gitea,github,
gitlab}.rs` expect a `(tenant_id, repo_id)` path tuple since the
M7.2-C tenant-in-URL migration. Any request hitting those API-server
routes would 500 on the path extraction mismatch — dead code from
the M7.2-C migration not propagating to this file.

The webhook handlers are still mounted correctly on the separate
webhook server (port 3002, `compliance-agent/src/webhooks/server.rs`)
with the `/webhook/{tenant_id}/{platform}/{repo_id}` form. That's
what the dashboard's webhook proxy forwards to.

No functional change — the broken routes never produced a successful
response, so removing them just drops the surface area.

Test plan
- cargo fmt --all clean
- cargo clippy -p compliance-agent -- -D warnings clean
- cargo test -p compliance-agent --lib — 228 pass (no change vs main)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

compliance-agent/src/api/routes.rs

@@ -2,7 +2,6 @@ use axum::routing::{delete, get, patch, post};
 use axum::Router;
 
 use crate::api::handlers;
-use crate::webhooks;
 
 pub fn build_router() -> Router {
     Router::new()
@@ -175,17 +174,10 @@ pub fn build_router() -> Router {
             "/api/v1/pentest/stats",
             get(handlers::pentest::pentest_stats),
         )
-        // Webhook endpoints (proxied through dashboard)
-        .route(
-            "/webhook/github/{repo_id}",
-            post(webhooks::github::handle_github_webhook),
-        )
-        .route(
-            "/webhook/gitlab/{repo_id}",
-            post(webhooks::gitlab::handle_gitlab_webhook),
-        )
-        .route(
-            "/webhook/gitea/{repo_id}",
-            post(webhooks::gitea::handle_gitea_webhook),
-        )
+    // Webhook routes live on the separate webhook server (port 3002,
+    // see crate::webhooks::server). The M7.2-C tenant-in-URL form is
+    // `/webhook/{tenant_id}/{platform}/{repo_id}` and the handlers
+    // expect a (tenant_id, repo_id) path tuple. Anything mounting
+    // them here on the API server would mismatch the handler
+    // signature, so the routes are not exported.
 }