refactor(api): remove the natural-language elaborate REST endpoint (Phase 3)

Chatbots now elaborate tasks in-conversation and submit them via the chatbot
MCP server, so the POST /api/tasks/elaborate shell-out path is no longer needed.
Removes the route, handleElaborateTask, and the task-elaborate-only helpers
(buildElaboratePrompt, sanitizeElaboratedTask, readProjectContext,
appendRawNarrative, elaborateWith{Claude,Local,Gemini}, and the elaboratedTask/
elaboratedAgent types) plus their dedicated tests.

Shared helpers (extractJSON, claude/geminiBinaryPath, claude/geminiJSONResult,
elaborateTimeout, the per-IP limiter) are retained — the story-elaborate
endpoint and task-validate endpoint still use them. Stories themselves are
untouched here; their removal stays in the Phase 8 cleanup pass.

https://claude.ai/code/session_01SESwn7kQ7oP62trWw6pc39

1 files changed, 0 insertions, 28 deletions

diff --git a/internal/api/server_test.go b/internal/api/server_test.go
index dd6eed5..43d91b0 100644
--- a/internal/api/server_test.go
+++ b/internal/api/server_test.go
@@ -1228,34 +1228,6 @@ func TestServer_AnswerQuestion_UpdateStateFails_Returns500(t *testing.T) {
 	}
 }
 
-func TestRateLimit_ElaborateRejectsExcess(t *testing.T) {
-	srv, _ := testServer(t)
-	// Use burst-1 and rate-0 so the second request from the same IP is rejected.
-	srv.elaborateLimiter = newIPRateLimiter(0, 1)
-
-	makeReq := func(remoteAddr string) int {
-		req := httptest.NewRequest("POST", "/api/tasks/elaborate", bytes.NewBufferString(`{"description":"x"}`))
-		req.Header.Set("Content-Type", "application/json")
-		req.RemoteAddr = remoteAddr
-		w := httptest.NewRecorder()
-		srv.Handler().ServeHTTP(w, req)
-		return w.Code
-	}
-
-	// First request from IP A: limiter allows it (non-429).
-	if code := makeReq("192.0.2.1:1234"); code == http.StatusTooManyRequests {
-		t.Errorf("first request should not be rate limited, got 429")
-	}
-	// Second request from IP A: bucket exhausted, must be 429.
-	if code := makeReq("192.0.2.1:1234"); code != http.StatusTooManyRequests {
-		t.Errorf("second request from same IP should be 429, got %d", code)
-	}
-	// First request from IP B: separate bucket, not limited.
-	if code := makeReq("192.0.2.2:1234"); code == http.StatusTooManyRequests {
-		t.Errorf("first request from different IP should not be rate limited, got 429")
-	}
-}
-
 func TestListWorkspaces_RequiresAuth(t *testing.T) {
 	srv, _ := testServer(t)
 	srv.SetAPIToken("secret-token")