refactor: final-review cleanup

- delete dead magic-link helpers (resolve_token, ensure_project_client,
  mint_link_token, provision_preview_session) + now-unused datetime import
- key brute-force lockout on link_token alone (IP term only enabled a
  source-IP-rotation bypass; behind the proxy all clients share one IP)
- drop unused PORTAL_BASE_URL from the retired CLI
- add WebSocket ownership tests (unauth + cross-project both close 1008)

backend/portal_admin.py

@@ -23,8 +23,6 @@ only its hash is stored.
 
   # revoke a link (stops the link AND any live session it minted)
   python3 backend/portal_admin.py revoke --token-id <TID>
-
-The printed URL base comes from PORTAL_BASE_URL (default http://localhost:8001).
 """
 
 import os
@@ -40,8 +38,6 @@ sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
 from backend.database import SessionLocal
 from backend.models import Client, ClientAccessToken, Project
 
-PORTAL_BASE_URL = os.getenv("PORTAL_BASE_URL", "http://localhost:8001").rstrip("/")
-
 
 def _get_client(db, slug):
     c = db.query(Client).filter_by(slug=slug).first()