chore(security): drop the unused enforceSecrets() duplicate

[maxmad64bis]

⚠️ base-red inherited: #9985

Summary

• enforceSecrets() in src/shared/utils/secretsValidator.ts validates the secrets and exits on
  error, and its only caller is src/server-init.ts — a module nothing imports. It reads like a
  guard that never runs.
• It is not one. enforceWebRuntimeEnv() (src/lib/env/runtimeEnv.ts) is called unconditionally
  from registerNodejs() and runs the same validateSecrets(); its errors are merged into the
  list that triggers process.exit(1). A missing or too-short API_KEY_SECRET already refuses to
  boot, and has since v3.6.6. enforceSecrets() is a strict subset of that check, so giving it a
  caller would refuse nothing the server does not already refuse.
• The duplicate goes instead. validateSecrets() — the logic both went through — is untouched.

Related Issues

• None filed upstream; found while auditing src/server-init.ts as dead code. chore(startup): remove server-init.ts, a module nothing imports #10780 removes that
  module.

Validation

• Change type: other (dead-code removal + regression test)
• Focused tests and category gates from the golden path: tests/unit/secrets-boot-guard.test.ts
  (8/8) and the two integration files that asserted on the removed function (87 pass, 4 skipped)
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR
• SonarQube is temporarily opt-in while the private project has no quota; it is not a PR gate.

Tests Added Or Updated

• tests/unit/secrets-boot-guard.test.ts (new, replaces tests/unit/enforce-secrets-boot-wiring.test.ts)
• tests/integration/integration-wiring.test.ts
• tests/integration/security-hardening.test.ts

The new file keeps the validateSecrets rule coverage and adds what nothing covered before: that
enforceWebRuntimeEnv() still runs after ensureSecrets() at boot, that secret errors stay in the
fatal list, and that no second enforce* entry point comes back.

Coverage Notes

• src/shared/utils/secretsValidator.ts loses a function and its branches; the remaining
  validateSecrets() keeps its direct coverage. src/server-init.ts loses an import and a call.
  No production code is added.

Reviewer Notes

• No behavior change: nothing that booted before is refused now, and nothing refused before boots.
• src/server-init.ts is touched only to drop the import and the call. chore(startup): remove server-init.ts, a module nothing imports #10780 removes that module
  outright; whichever lands second needs a trivial rebase.
• The branch name (fix/wire-enforce-secrets) predates the change of approach — this PR removes
  the function rather than wiring it.