chore(canary): drop unused auth error helpers from core

Auth-template residue in core/errors.go + core/response.go:

  - UnauthorizedError() / ForbiddenError() + Err{Unauthorized,Forbidden}
    sentinels
  - TokenExpiredError() / TokenInvalidError() / TokenRevokedError() +
    Err{TokenExpired,TokenInvalid,TokenRevoked} sentinels
  - core.Unauthorized() / core.Forbidden() response wrappers

Zero call sites anywhere in the codebase. Worse, the Token*Error names
semantically collide with canary tokens (same package, completely
unrelated meaning) — a future-reader trap that would compound once
Phase 9 wires real operator-bearer auth gates on the admin handler.

Generic AppError plumbing (NewAppError, NotFoundError, DuplicateError,
ValidationError, InternalError, RateLimitError, IsAppError, GetAppError)
is preserved — all in active use.

When Phase 9 needs operator-bearer or turnstile-gated responses, helpers
can be reintroduced with names appropriate to the actual auth design
rather than carrying generic JWT-shaped vocabulary forward into a
canary-token namespace.

Surfaced by the pre-Phase-5 cross-phase alignment audit. Cleared per
the fix-in-phase rule. BACKLOG closed section records the resolution.

PROJECTS/beginner/canary-token-generator/backend/internal/core/errors.go

@@ -14,14 +14,9 @@ var (
 	ErrDuplicateKey = errors.New("duplicate key violation")
 	ErrForeignKey   = errors.New("foreign key violation")
 	ErrInvalidInput = errors.New("invalid input")
-	ErrUnauthorized = errors.New("unauthorized")
-	ErrForbidden    = errors.New("forbidden")
 	ErrInternal     = errors.New("internal server error")
 	ErrConflict     = errors.New("resource conflict")
 	ErrRateLimited  = errors.New("rate limit exceeded")
-	ErrTokenExpired = errors.New("token expired")
-	ErrTokenInvalid = errors.New("token invalid")
-	ErrTokenRevoked = errors.New("token revoked")
 )
 
 type AppError struct {
@@ -86,30 +81,6 @@ func ValidationError(message string) *AppError {
 	}
 }
 
-func UnauthorizedError(message string) *AppError {
-	if message == "" {
-		message = "authentication required"
-	}
-	return &AppError{
-		Err:        ErrUnauthorized,
-		Message:    message,
-		StatusCode: http.StatusUnauthorized,
-		Code:       "UNAUTHORIZED",
-	}
-}
-
-func ForbiddenError(message string) *AppError {
-	if message == "" {
-		message = "access denied"
-	}
-	return &AppError{
-		Err:        ErrForbidden,
-		Message:    message,
-		StatusCode: http.StatusForbidden,
-		Code:       "FORBIDDEN",
-	}
-}
-
 func InternalError(err error) *AppError {
 	return &AppError{
 		Err:        err,
@@ -128,33 +99,6 @@ func RateLimitError() *AppError {
 	}
 }
 
-func TokenExpiredError() *AppError {
-	return &AppError{
-		Err:        ErrTokenExpired,
-		Message:    "token has expired",
-		StatusCode: http.StatusUnauthorized,
-		Code:       "TOKEN_EXPIRED",
-	}
-}
-
-func TokenInvalidError() *AppError {
-	return &AppError{
-		Err:        ErrTokenInvalid,
-		Message:    "invalid token",
-		StatusCode: http.StatusUnauthorized,
-		Code:       "TOKEN_INVALID",
-	}
-}
-
-func TokenRevokedError() *AppError {
-	return &AppError{
-		Err:        ErrTokenRevoked,
-		Message:    "token has been revoked",
-		StatusCode: http.StatusUnauthorized,
-		Code:       "TOKEN_REVOKED",
-	}
-}
-
 func IsAppError(err error) bool {
 	var appErr *AppError
 	return errors.As(err, &appErr)

PROJECTS/beginner/canary-token-generator/backend/internal/core/response.go

@@ -96,14 +96,6 @@ func NotFound(w http.ResponseWriter, resource string) {
 	JSONError(w, NotFoundError(resource))
 }
 
-func Unauthorized(w http.ResponseWriter, message string) {
-	JSONError(w, UnauthorizedError(message))
-}
-
-func Forbidden(w http.ResponseWriter, message string) {
-	JSONError(w, ForbiddenError(message))
-}
-
 func InternalServerError(w http.ResponseWriter, err error) {
 	slog.Error("internal server error", "error", err)
 	JSONError(w, InternalError(err))