Remove legacy bx user/role/menu/auth APIs. Wire auth store to portal temporarily so the app still typechecks; IAM admin pages use local stubs until Task 6 drops their routes. Co-authored-by: Cursor <cursoragent@cursor.com>