feat: sync open-source context and capsule removal

- remove legacy contexts surfaces from the app, MCP bridge, standalone server, and docs
- keep getContext and retrieveQueryContext while aligning the simplified graph-only contract
- harden dev startup migration behavior and disable the accidental chat surface in open source

Generated with Codex

app/api/retrieval/query-context/route.ts

@@ -1,9 +1,12 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { applyRequestSupabaseAuth } from '@/services/auth/internalAuth';
 import { retrieveQueryContext } from '@/services/retrieval/queryContext';
 
 export const runtime = 'nodejs';
 
 export async function POST(request: NextRequest) {
+  const cleanupAuth = applyRequestSupabaseAuth(request);
+
   try {
     const body = await request.json();
     const query = typeof body.query === 'string' ? body.query : '';
@@ -18,7 +21,6 @@ export async function POST(request: NextRequest) {
     const result = await retrieveQueryContext({
       query,
       focused_node_id: typeof body.focused_node_id === 'number' ? body.focused_node_id : null,
-      active_context_id: typeof body.active_context_id === 'number' ? body.active_context_id : null,
       limit: typeof body.limit === 'number' ? body.limit : undefined,
     });
 
@@ -31,5 +33,7 @@ export async function POST(request: NextRequest) {
       success: false,
       error: error instanceof Error ? error.message : 'Failed to retrieve query context',
     }, { status: 500 });
+  } finally {
+    cleanupAuth();
   }
 }