backend/src/auth/claims.rs was orphaned dead code: auth/mod.rs never
declared 'mod claims', so the file wasn't compiled into the crate at
all. It defined two structs:
- AccessClaims — referenced nowhere; a latent trap (carried
family_id/permissions fields that suggested enforcement that doesn't
exist).
- RefreshClaims — a duplicate of the LIVE RefreshClaims in jwt.rs,
which is what JwtService actually uses.
Deleted the file. Updated the JWT ADR to mark the open item done and
note the removal historically.
Build/clippy/fmt clean (the file wasn't compiled anyway). Closes#5.
