refactor: rip out the legacy TrackedRepository / repositories path

Onboarded targets are now the sole persisted entity. The legacy
`TrackedRepository` model, the `repositories` collection, the `/repositories`
API, the Repositories dashboard page, the one-shot migration, and the
`UNIFIED_PIPELINE` transition flag are all removed. Net −1.7k LOC.

Agent
- New internal `pipeline::repo_view::RepoView` (non-persisted) replaces the
  `TrackedRepository` model; it's projected from an `OnboardedTarget` + its code
  artifact by `RepoView::from_target` (the old `repo_view_from_target`), so the
  scan/PR-review pipeline is byte-for-byte the same behaviour it already ran on
  the unified path — only the type's origin changed.
- `run_scan` always runs the unified `run_target`; the legacy `orchestrator::run`
  and the `unified_pipeline` flag are gone. `run_pr_review` resolves the target
  from `onboarded_targets`.
- Webhooks (github/gitea/gitlab), the CVE monitor, graph build, chat embeddings,
  health stats, and the pentest repo lookup all read `onboarded_targets`.
- `delete_target` now cascades the full downstream set (findings, sbom, scans,
  cve, tracker issues, graph, embeddings, DAST targets + pentest sessions and
  their children) — matching the old repository delete.
- `get_ssh_public_key` moved to the health handler; `repositories()` accessor,
  `repos.rs`, and `migrate/` deleted.

Core
- `TrackedRepository` removed; `ScanTrigger` stays. `unified_pipeline` config
  field removed.

Dashboard
- Repositories page + route deleted; overview / graph / chat / pentest-wizard
  read onboarded targets; `infrastructure/repositories.rs` trimmed to just the
  SSH-key fetch.

Tests
- Legacy repositories-API and migration integration tests removed; tenant
  isolation, cascade-delete, and stats tests repointed to `/targets` /
  `onboarded_targets`. `git.rs` gains a `sanitize_repo_dir` unit test.

Local: fmt clean; agent/mcp clippy clean; dashboard server+web compile; core +
agent lib tests (32) pass; integration tests compile.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

compliance-agent/tests/tenant_isolation.rs

@@ -11,7 +11,7 @@
 #![allow(clippy::expect_used, clippy::unwrap_used)]
 
 use compliance_agent::database::DatabasePool;
-use compliance_core::models::TrackedRepository;
+use compliance_core::models::{Artifact, OnboardedTarget, TargetType};
 use compliance_core::{OrgRole, TenantContext, TenantStatus};
 use mongodb::bson::doc;
 
@@ -28,27 +28,12 @@ fn ctx(tenant_id: &str, slug: &str) -> TenantContext {
     }
 }
 
-fn fixture_repo(name: &str, git_url: &str) -> TrackedRepository {
-    TrackedRepository {
-        id: None,
-        name: name.to_string(),
-        git_url: git_url.to_string(),
-        default_branch: "main".to_string(),
-        local_path: None,
-        scan_schedule: None,
-        webhook_enabled: false,
-        webhook_secret: None,
-        tracker_type: None,
-        tracker_owner: None,
-        tracker_repo: None,
-        tracker_token: None,
-        auth_token: None,
-        auth_username: None,
-        last_scanned_commit: None,
-        findings_count: 0,
-        created_at: chrono::Utc::now(),
-        updated_at: chrono::Utc::now(),
-    }
+fn fixture_repo(name: &str, git_url: &str) -> OnboardedTarget {
+    let mut target = OnboardedTarget::new(name.to_string(), TargetType::WebApp);
+    target
+        .artifacts
+        .push(Artifact::git_repo(git_url.to_string(), "main".to_string()));
+    target
 }
 
 #[tokio::test]
@@ -71,12 +56,12 @@ async fn pool_isolates_tenants_at_driver_level() {
 
     // Write distinct repos into each tenant's database.
     acme_db
-        .repositories()
+        .onboarded_targets()
         .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
         .await
         .expect("insert acme");
     globex_db
-        .repositories()
+        .onboarded_targets()
         .insert_one(fixture_repo(
             "globex-platform",
             "git@example.com:globex/platform.git",
@@ -173,12 +158,12 @@ async fn admin_helpers_list_and_drop_tenant_dbs() {
     let acme_db = pool.for_tenant(&acme).await.expect("acme db");
     let globex_db = pool.for_tenant(&globex).await.expect("globex db");
     acme_db
-        .repositories()
+        .onboarded_targets()
         .insert_one(fixture_repo("acme-app", "git@example.com:acme/app.git"))
         .await
         .expect("insert acme");
     globex_db
-        .repositories()
+        .onboarded_targets()
         .insert_one(fixture_repo("globex-app", "git@example.com:globex/app.git"))
         .await
         .expect("insert globex");
@@ -284,9 +269,9 @@ fn short_id() -> String {
 }
 
 /// Drain a `repositories` find cursor on the given tenant database.
-async fn collect(db: &compliance_agent::database::Database) -> Vec<TrackedRepository> {
+async fn collect(db: &compliance_agent::database::Database) -> Vec<OnboardedTarget> {
     let mut cursor = db
-        .repositories()
+        .onboarded_targets()
         .find(doc! {})
         .await
         .expect("find repositories");