chore(frontend): remove the icon library nothing imports, and the migration language around it

[YaelAnaya]

The migration is finished, so this removes what only made sense while it was
running: an icon library nothing imports, a gate shaped for a dependency that no
longer exists, and six statements describing a state the product left behind.

Seventeen categories were audited. Three produced changes. The rest were already
clean, and saying so with evidence is part of the result - a cleanup phase that
deletes something from every category it opens is a phase that deleted things it
did not understand.

What was removed

The icon library. lucide-react has no importer anywhere: not the product, not
the annotator, not the demo, not a test, not the benchmark. Both manifests that
declared it are cleaned, the lockfile is resolved from scratch against them, and a
frozen install runs from an empty tree - so this is not a manifest edit hoping the
lockfile agrees.

A gate that had outlived its shape. The scan added when the workspace migrated
read one directory for the package's name. That was right while the dependency was
declared and a stray import would resolve, build and render. With the dependency
gone such an import fails outright, and the half that now needs guarding is the
manifest: declare the package again and the whole problem returns with nothing to
say so. The invariant moves beside the other design gates, asserts both halves over
the whole tracked tree, and was checked by breaking each half separately.

Six stale statements. DESIGN.md and the frontend setup skill both said Lucide
survived in the annotation workspace. Both were wrong the day they were written:
the change that wrote them is the change that migrated that directory. The
architecture note repeated it, the ui-core barrel still credited "Radix + lucide
only (decision H)", and the demo's tool strip explained its hand-drawn glyphs by
citing a pin DESIGN.md dropped when the preset landed. DESIGN.md now points at
the gate rather than at a directory, so the claim cannot go stale the same way.

What was audited and kept, with the evidence

Four dependencies that looked unused are not. tw-animate-css, shadcn and
both @fontsource-variable packages have no TypeScript importer, and all four
arrive through @import in styles.css. shadcn in particular is a runtime CSS
dependency here, not only the CLI. An import scan that reads only TypeScript is
exactly the false positive this phase is most likely to act on.

Every extension token is live. All seven - stage, brand, success,
warning and the three origin-* marks - are declared in both themes and used
between one and ten times. None is dead.

No dead components, and no export removals. Every module under
frontend/ui-core/src has a consumer. The barrels were left alone on purpose:
@visionset/ui-core and @visionset/annotator are private: false with files
and main set, and docs/content/releasing.md describes publishing them, so their
exports are an external contract that in-repo usage cannot declare dead.

The /inference redirect stays. Its own comment argues it - a bookmarked URL is
a promise. A deliberate redirect is compatibility, not dead code.

The retired token vocabulary is already absent, the primitives carry no
compatibility branch or deprecated variant, and the remaining "workaround" comments
explain why today's code differs from what came before, which is the kind that
earns its place.

Test plan

Every command ran inside Docker/Linux; no repository validation ran natively on the
host.

install (pnpm install --frozen-lockfile, from an empty tree)  PASS
build (pnpm -r build)                                         PASS
@visionset/ui-core lint (incl. typecheck)                     PASS
@visionset/ui-core test                                       PASS
@visionset/app build                                          PASS
@visionset/app lint                                           PASS
@visionset/annotator test                                     PASS
pnpm test:scripts                                             PASS
pnpm version:check                                            PASS

full browser suite                                            261 passed

A cleanup is behaviour-neutral or it is not cleanup, so eleven surfaces were loaded
and watched: Home, Projects, Models, Overview, Schema, Batches, Dataset, Ingest,
Gallery, the styleguide and the demo. All render, every one paints Tabler glyphs
(2 to 22 of them), no module fails to resolve and no style is missing.

Two console errors turned up and neither belongs to this branch. Thumbnail reads
were answering 500 from a PermissionError on /data/dev/blobs - a development
workspace whose blob directory is owned by root, which is the same environment
fault that made the API refuse to open its database earlier today, and not
something the repository can fix. The other is a 404 on
schema/drafts/curated: the screen asking whether a draft exists and being told it
does not, which ui-core already covers with a test that resolves that 404 to null
in exactly one request.

Overlap

The frontend dependency bump (#768) edits frontend/app/package.json,
frontend/ui-core/package.json and pnpm-lock.yaml - the three files this branch
touches, on the same lines, to raise the version of the package being removed.
DEPENDENCY OVERLAP. It should be rebased rather than merged around: the entry
it raises is gone, and the four other bumps it carries are unaffected by this.

Scope

Public API removals:       None
Routes changed:            No
Product IA changed:        No
Backend / wire / domain:   No
Annotator behaviour:       No

Remaining debt

Nothing legacy. What is left is product work rather than migration residue: a
visual-regression baseline still wants stabilised fixtures before it is worth
having, and hostile-content coverage beyond a long name and description - a long
class name, a long model reference, a large annotation count - wants a fixture
because the schema write path refuses the shape an API call would use to seed it.