Delete the bespoke page-grant middleware (A2)

This app attached an Enforce*PageGrant middleware at runtime via a
RouteMatched listener, consulting its own private *_page_grants table to
decide whether the request could proceed.

Safe to remove because the middleware only ever NARROWED routes that
already carry a `permission:` gate. Three independent audits agreed on
that for all eleven apps: no route relied on it as its sole
authorization, so deleting it cannot widen access — the permission the
route already declares still decides.

Two cases were not simply narrowing, and both were handled first:

- unifi's guest-Wi-Fi card poll was `auth`-only and leaked the live guest
  password to any signed-in account. Closed in 9cbc8e6 before this, so
  this commit does not reopen it.
- google's middleware had NO permission-holder bypass, so it could deny a
  legitimate google.manage holder. Deleting it restores their access.

What is deliberately NOT done here: the grant tables, models and the fold
in User::pageGrantedPermissions() all remain, so a grant row can still ADD
access. It can no longer 404 anybody. The fold goes last, together with
the characterisation tests that pin it.

Verified: pages in all four de-gated apps return 200, the affected suites
pass, and dashboard:doctor's advisories drop from 18 to 7.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RDA3fQbsa3gaHCFoV1Q8Gg

src/UnifiServiceProvider.php

@@ -4,8 +4,6 @@ namespace Dashboard\Unifi;
 
 use App\Models\NavItem;
 use Dashboard\Unifi\Models\UnifiPageGrant;
-use Illuminate\Routing\Events\RouteMatched;
-use Illuminate\Support\Facades\Event;
 use Illuminate\Support\ServiceProvider;
 
 class UnifiServiceProvider extends ServiceProvider
@@ -55,20 +53,6 @@ class UnifiServiceProvider extends ServiceProvider
             // Sidebar will fall back to legacy permission filter.
         }
 
-        // Per-page enforcement for unifi pages. Settings stays on its
-        // permission:unifi.settings route middleware (the Access tab
-        // itself lives there and must not be able to lock itself out).
-        // The user-dependent check lives in middleware appended to the
-        // matched route: RouteMatched fires before the session/auth
-        // middleware run, so request->user() is null here and any check
-        // at this point silently fails open.
-        Event::listen(RouteMatched::class, function (RouteMatched $event) {
-            $routeName = $event->route->getName();
-            if (! $routeName || ! str_starts_with($routeName, 'unifi.')) return;
-            if (str_starts_with($routeName, 'unifi.settings')) return;
-
-            $event->route->middleware(\Dashboard\Unifi\Http\Middleware\EnforceUnifiPageGrant::class);
-        });
 
         if ($this->app->runningInConsole()) {
             $this->commands([