Fjerne ubrukte endepunkter fra oed

> [!WARNING]
> Claude har funnet følgende endepunkter som ubrukte eller bare tilgjengelige i test. Det må gjøres en grundig vurdering for hvert enkelt endepunkt før det fjernes de.

## Unused and environment-hidden endpoints in the OED backend

Audit of every routed endpoint in `App/`, cross-checked against the React frontend,
the test suites, and `applicationmetadata.json`. Grouped by what needs deciding.

### 1. **[DONE]** Endpoint hidden behind an environment check

#### **[DONE]** `POST {org}/{app}/api/generate-declaration-submitted`
`App/Controllers/CloudEventDeclarationController.cs:106`

A test harness. Takes a deceased nin plus a case id, creates an oed-declaration
instance if none exists, and fires a synthetic `DeclarationSubmitted` cloud event.
Returns 405 when the host environment is Production, so it is live in Development,
Staging and TT02.

- **No `[Authorize]` at all.** The class carries only a route; the sibling cloudevent
endpoint has its own policy. In staging it is anonymous and will create instances
and post events for any nin supplied.
- Deliberately published in Swagger via the inclusion predicate in
`App/Extensions/ServiceCollectionExtensions.cs:138`.
- Request model is named `ProbateDeclarationSubmittedTestModel`.

### 2. Endpoints with no caller left

#### `GET` / `POST {org}/{app}/api/testamente/{partyId}/{instanceGuid}`
`App/Controllers/TestamentController.cs`

Last frontend caller deleted in November 2023, in commit `8a18e1e5` titled
"Delete unused code". Nothing in the repository references the route. The POST writes
data type `testamente`, which does **not** exist in
`App/config/applicationmetadata.json`, so it would fail against Storage if called.

#### `GET` / `POST {org}/{app}/api/ektepakt/{partyId}/{instanceGuid}`
`App/Controllers/MarriagePactController.cs`

Dead since April 2022. The live marriage-pact path is the register lookup at
`externalapi/ektepakt`, a different controller. This one writes data type
`ektepaktUser`, also absent from application metadata.

#### `GET` / `POST {org}/{app}/api/statusnotifications/{partyId}/{instanceGuid}`
`App/Controllers/StatusNotificationController.cs`

No caller anywhere. Unlike the two above it writes the `event` data type, which does
exist, so it would actually work. It is simply unused.

#### `GET {org}/{app}/CustomIndex`
`App/Controllers/LocaltestCustomHomeController.cs`

Last touched January 2023. Its own comment says the URL is rewritten in `startup.cs`
to invoke it, but that wiring is gone, and nothing mentions the route or its
`OED-instance-redirect` cookie.

- **Mapped in every environment.** No environment guard, no `[Authorize]`.
- Reads the local directory `C:\AltinnPlatformLocal\documentdb\instances`.
- Parses the party id claim with `int.Parse` over an empty-string fallback, so in
production it throws rather than doing anything. It should not be routable at all.

#### `GET {org}/{app}/api/config/{masterKeyVault}/{comparedKeyVault}`
`App/Controllers/ConfigHandling/ConfigHandlingController.cs`

**Highest priority.** An operator diagnostic that compares two Azure Key Vaults and
returns which secret names are missing and which *values differ*. No caller in the repo.

- **No `[Authorize]` and no environment guard.** There is no fallback authorization
policy in `Program.cs`, so it is anonymous in production.
- Authenticates to Key Vault with the app's own managed identity.
- The class is also misnamed `ClientLogController` inside `ConfigHandlingController.cs`.

### 3. Duplicate and superseded routes

#### Bare `GET {org}/{app}/api/externalapi`
`App/Controllers/ExternalAPIController.cs:69`

`GetKartverket` carries both a parameterised `[HttpGet("kartverket/...")]` and a bare
`[HttpGet]`. The bare one exposes the group root, where neither route parameter can
bind. Leftover, no caller.

#### `POST .../invoke/subapp` duplicating `POST .../subapps/invoke`
`App/Features/SubApp/WebAppExtensions.cs:33` and `:38`

Both map the identical handler. The code already carries a `TODO` to remove the
`invoke/subapp` route once the frontend moves. The frontend currently calls the old
one, in `subappSlice.ts`.

#### `GET .../invoke/declaration`
`App/Controllers/AppController.cs:195`

The legacy browser-navigation sub-app flow. Still reachable from the frontend, but only
on the `ProbateChoicesLegacy` path behind the `useNewAppRedirectUrl` localStorage flag.
Retires when that flag does.

#### `POST {org}/{app}/api/admin/migrate-declaration`
`App/Features/Admin/WebAppExtensions.cs:20`

Not dead code, and properly guarded by the `SystemAdmin` Maskinporten scope. Listed only
because it is a one-off data migration endpoint. If the migration has run, it is a
permanent write path with no remaining purpose.

### 4. Dead frontend helpers pointing at these

`App/react/altinn-app-frontend/src/utils/urlHelper.ts` exports `getVehicleApiUrl`,
`getTaxApiUrl`, `getInsuranceApiUrl` and `getPropertyApiUrl`. None are imported
anywhere. `getTaxApiUrl` builds a URL for `externalapi/skatt`, and no such endpoint
exists in the backend.

### Suggested order of work

1. Remove or lock down the Key Vault comparison endpoint.
2. Remove `LocaltestCustomHomeController`.
3. Add authorization to `generate-declaration-submitted`, or move it out of the app.
4. Delete the three orphan controllers and the dead `urlHelper` exports.
5. Drop the bare `[HttpGet]` on `GetKartverket`.
6. Point the frontend at `subapps/invoke` and delete `invoke/subapp`