chore(edge): remove only verified fixed-universe duplicate collectors

## Summary

This issue supersedes only the safe cleanup portion of #6237.

Some server-side fetch helpers duplicate Railway seeders over a fixed input universe and should be removed after a caller/parity audit. Market and WTO helpers are deliberately excluded because their parameterized RPC contracts currently exceed seed coverage and may need those seams restored as bounded cached gap fetchers.

## Candidate cleanup clusters

### Cyber

Audit and remove the fixed-feed collectors in `server/worldmonitor/cyber/v1/_shared.ts` when their Railway equivalents are proven complete:

- `fetchFeodoSource`
- `fetchUrlhausSource`
- `fetchC2IntelSource`
- `fetchOtxSource`
- `fetchAbuseIpDbSource`
- `hydrateThreatCoordinates`

Move only the constants/types still needed by `list-cyber-threats.ts` into a constants-only module.

### BIS / fixed economic helpers

Re-verify callers and seeder parity for:

- `server/worldmonitor/economic/v1/_bis-shared.ts`
- `server/worldmonitor/economic/v1/_shared.ts`
- `server/worldmonitor/economic/v1/_fetch-with-timeout.ts`

Delete only functions whose full fixed request universe is owned by Railway and whose request contract has no uncovered parameter combinations.

### AviationStack

Re-verify and remove the obsolete direct AviationStack delay collectors in `server/worldmonitor/aviation/v1/_shared.ts`. PR #858 intentionally moved this work to Railway after per-airport Vercel fan-out caused severe provider cost.

## Explicitly out of scope

- Market provider helpers until #6304, #6305, #6306, #6307, and #6308 resolve the provider and parameterized quote contracts.
- `trade/v1/_shared.ts::wtoFetch` until #6309 resolves WTO reporter/partner/year coverage.
- The FMP plan, now tracked explicitly in #6304.

## Acceptance criteria

- [ ] Every deleted export has a repo-wide zero-caller proof at the implementation head.
- [ ] For each fixed-universe collector, a parity table maps inputs, normalization, validation, freshness, and publication keys to its Railway owner.
- [ ] Any live constants/types are moved without retaining provider code in the imported module.
- [ ] No parameterized request contract loses coverage or becomes silently seed-only.
- [ ] Claims about shipped bundle contents are backed by the actual edge bundle, not source-import assumptions.
- [ ] Secret references are removed only when no remaining supported runtime uses them.
- [ ] Focused cyber/economic/aviation tests, edge bundle checks, `npm run typecheck`, and `npm run typecheck:api` pass.
- [ ] The final diff contains no market or WTO deletions owned by the linked restoration issues.

## Related

- #6237
- #858

Start with the candidate files in server/worldmonitor/cyber/v1/_shared.ts, server/worldmonitor/economic/v1/_bis-shared.ts, server/worldmonitor/economic/v1/_shared.ts, server/worldmonitor/economic/v1/_fetch-with-timeout.ts, and server/worldmonitor/aviation/v1/_shared.ts; trace callers and compare each fixed request universe with its Railway seeder. Done means only verified zero-caller, fully covered collectors are removed, required constants and types remain available, focused tests and edge bundle checks pass, and both typecheck commands succeed.

Written by the indexing model from the issue text.