refactor: retire interim magic-link/open-link in favor of password gate

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_retired_routes.py

@@ -0,0 +1,19 @@
+from tests.conftest import make_project
+
+
+def test_enter_and_open_are_gone(client, db_session):
+    assert client.get("/portal/enter/anything", follow_redirects=False).status_code == 404
+    assert client.get("/portal/open/anything", follow_redirects=False).status_code == 404
+
+
+def test_portal_link_endpoints_are_gone(client, db_session):
+    p = make_project(db_session)
+    assert client.post(f"/projects/{p.id}/portal-link").status_code == 404
+    assert client.get(f"/projects/{p.id}/portal-links").status_code == 404
+
+
+def test_preview_still_mints_a_session(client, db_session):
+    p = make_project(db_session)
+    r = client.get(f"/projects/{p.id}/portal-preview", follow_redirects=False)
+    assert r.status_code == 303
+    assert "portal_session=" in r.headers.get("set-cookie", "")