chore(api): delete the orphan /api/audit-log surface and seed the five README-tied admin orphans into v1.4.28

The /api/audit-log GET handler has zero runtime callers in src/, tests/,
scripts/, or docs/ — verified via grep against the route path plus the
auditLog model name. The admin counterpart at /api/admin/audit-log is
the surface every consumer reads from. Drops the orphan route file
outright per the v1.4.27 fix-plan Section 4 Decision A.

The five admin / monitoring endpoints flagged for the scope-
maximization sweep all carry a README + CHANGELOG documentation
reference, which the fix-plan classes as a consumer for the
defer-on-tie rule:

  /api/admin/ai-settings           — README L362–363, CHANGELOG L752
  /api/admin/backup/test           — README L368,    CHANGELOG L752
  /api/admin/status-overview       — README L367,    CHANGELOG L753
  /api/monitoring/glitchtip/test   — README L381
  /api/monitoring/umami/test       — README L382

All five defer to v1.4.28 for a maintainer call — either wire each to
a real consumer or drop the route + README mention together. Seeds
the v1.4.28 backlog entry with the per-endpoint grep findings so the
decision is one read away.

Also seeds the v1.4.28 backlog with the missing `insights.coach.window.lastYear`
i18n key across the six locale bundles — owned by the i18n bucket.

.planning/v1428-backlog.md

@@ -11,3 +11,14 @@ Items deferred from v1.4.27 with a clear rationale. Sorted by source bucket.
 ## From bucket B1 — Dashboard rebuild (v1.4.27)
 
 - **F7 weekly-report dead click — needs maintainer screenshot.** Scan budget (30 min) across `src/` and `messages/` returned no dead affordance. Every weekly-report click target on `/insights` routes correctly to `/insights/report/[week]`. The retired `<InsightsCardPreview>` was the only dashboard-anchored insight CTA in v1.4.27 — its removal in B1 commit 3 is the most likely reason the maintainer perceived a dead click. Ask the maintainer to point at the dead element with a screenshot. If they confirm the dashboard side, add a slim "Wochenreport für KW {N}" banner on `/` mirroring the `<WeeklyReportBanner>` from the hero, gated on a fresh advisor payload.
+
+## From bucket B7 — Symmetry sweep + dead-code cleanup (v1.4.27)
+
+- **README-referenced admin / monitoring orphan endpoints.** Five endpoints flagged by R1.6 as candidate-orphan have no runtime caller in `src/` but are documented as part of the API surface in `README.md` lines 362–382 + `CHANGELOG.md` 752–753. Per the v1.4.27 fix-plan scope-maximization directive ("if a consumer surfaces e.g. CI script, uptime probe, README reference, defer that single endpoint to v1.4.28"), each of the five defers:
+  - `/api/admin/ai-settings` (GET + PUT) — README line 362–363 + CHANGELOG 752 + 3261.
+  - `/api/admin/backup/test` (POST) — README line 368 + CHANGELOG 752.
+  - `/api/admin/status-overview` (GET) — README line 367 + CHANGELOG 753 + AGENTS.md 194.
+  - `/api/monitoring/glitchtip/test` (POST) — README line 381.
+  - `/api/monitoring/umami/test` (POST) — README line 382.
+  - **Decision needed:** either wire each endpoint to a real consumer (admin Settings UI, ops dashboard, uptime probe) or drop both the route and the README mention in the same commit. The README mention alone is not load-bearing if no operator reads it; a 30-second `gh search code` over the public mirrors of HealthLog deployments would tell us whether a downstream operator scripts against any of them.
+- **i18n key `insights.coach.window.lastYear` missing across six locales.** B7 commit 6 added the `lastYear` snapshot-window enum value and wired the source-chip resolver to look up `insights.coach.window.lastYear`. The key resolves through the i18n fallback chain to the raw key string today; B6 (the i18n bucket) owns messages/*.json and should add the key to all six locales in v1.4.28. EN copy: "year so far"; DE: "Jahresrückblick"; FR/ES/IT/PL: respective locale-native translations.

src/app/api/audit-log/route.ts

@@ -1,46 +0,0 @@
-import { prisma } from "@/lib/db";
-import { apiHandler, requireAuth } from "@/lib/api-handler";
-import { annotate } from "@/lib/logging/context";
-import { apiSuccess } from "@/lib/api-response";
-import { NextRequest } from "next/server";
-
-/**
- * Get audit log entries for the current user.
- * Query params: limit (default 50, max 200), offset (default 0)
- */
-export const GET = apiHandler(async (request: NextRequest) => {
-  const { user } = await requireAuth();
-  annotate({ action: { name: "audit-log.list" } });
-
-  const { searchParams } = new URL(request.url);
-  const limit = Math.min(
-    Math.max(1, parseInt(searchParams.get("limit") ?? "50", 10) || 50),
-    200,
-  );
-  const offset = Math.max(
-    0,
-    parseInt(searchParams.get("offset") ?? "0", 10) || 0,
-  );
-
-  const [entries, total] = await Promise.all([
-    prisma.auditLog.findMany({
-      where: { userId: user.id },
-      orderBy: { createdAt: "desc" },
-      take: limit,
-      skip: offset,
-      select: {
-        id: true,
-        action: true,
-        ipAddress: true,
-        location: true,
-        details: true,
-        createdAt: true,
-      },
-    }),
-    prisma.auditLog.count({
-      where: { userId: user.id },
-    }),
-  ]);
-
-  return apiSuccess({ entries, meta: { total, limit, offset } });
-});