refactor: remove obsolete resource download and installer endpoints

- Deleted the `POST /resources/get/{dataFolder?}` and `GET /resources/get-installer` endpoints as part of the architectural shift towards simplified resource management.
- Removed associated methods and configurations, including `ResourcesService.GetEncryptedResource`, `ResourcesService.GetInstaller`, and related properties in `ResourcesConfig`.
- Cleaned up environment variables and configuration files to reflect the removal of installer-related settings.
- Eliminated the `GetResourceRequest` DTO and its validator, along with the `WrongResourceName` error code.
- Updated documentation to clarify the changes in resource handling and the retirement of per-user file encryption.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_document/modules/admin_api_program.md

@@ -6,6 +6,8 @@ Application entry point: configures DI, middleware, authentication, authorizatio
 ## Public Interface (HTTP Endpoints)
 
 > **Cycle 1 (2026-05-13) note** — endpoint surface changed by AZ-513 (detection-class CRUD), AZ-196 (device auto-registration), AZ-197 (hardware-binding removal). AZ-183 (OTA update check + publish) was reverted later the same day after the security audit (finding F-1) — the OTA delivery model itself was deemed obsolete; see `_docs/05_security/security_report.md` for context. The table reflects the post-cycle-1 state including that revert.
+>
+> **Cycle 2 (2026-05-14) note** — three more endpoints were removed as obsolete: `POST /resources/get/{dataFolder?}`, `GET /resources/get-installer`, `GET /resources/get-installer/stage`. The encrypted-download support stack (`Security.GetApiEncryptionKey` / `EncryptTo` / `DecryptTo`, `ResourcesService.GetEncryptedResource` / `GetInstaller`, `GetResourceRequest` DTO, `WrongResourceName = 50` enum value, `ResourcesConfig.SuiteInstallerFolder` / `SuiteStageInstallerFolder`) went with them. ADR-003 in `architecture.md` was retired in the same change.
 
 | Method | Path | Auth | Summary | Cycle 1 origin |
 |--------|------|------|---------|----------------|
@@ -22,23 +24,23 @@ Application entry point: configures DI, middleware, authentication, authorizatio
 | POST | `/resources/{dataFolder?}` | Any authenticated | Uploads a resource file | — |
 | GET | `/resources/list/{dataFolder?}` | Any authenticated | Lists files in a resource folder | — |
 | POST | `/resources/clear/{dataFolder?}` | ApiAdmin | Clears a resource folder | — |
-| POST | `/resources/get/{dataFolder?}` | Any authenticated | Downloads an encrypted resource (key derived from `email + password` only) | AZ-197 wire change (no `Hardware` field) |
-| GET | `/resources/get-installer` | Any authenticated | Downloads latest production installer | — |
-| GET | `/resources/get-installer/stage` | Any authenticated | Downloads latest staging installer | — |
 | POST | `/classes` | ApiAdmin | Creates a detection class | AZ-513 |
 | PATCH | `/classes/{id:int}` | ApiAdmin | Updates a detection class (partial-merge) | AZ-513 |
 | DELETE | `/classes/{id:int}` | ApiAdmin | Deletes a detection class | AZ-513 |
 
-### Removed in cycle 1
+### Removed endpoints
 
-The following endpoints were removed during cycle 1 and now return `404`:
+The following endpoints have been removed and now return `404`:
 
-| Method | Path | Reason removed |
-|--------|------|----------------|
-| PUT | `/users/hardware/set` | AZ-197 — hardware-binding feature deleted (no fielded clients in target architecture) |
-| POST | `/resources/check` | AZ-197 — was the hardware-binding side-effect probe; no remaining purpose |
-| POST | `/get-update` | OTA delivery model retired post-cycle-1 (security audit F-1: endpoint disclosed plaintext per-resource encryption keys to any authenticated caller; the underlying installer-distribution flow is itself obsolete) |
-| POST | `/resources/publish` | Same revert as `/get-update` — the publish counterpart of the OTA flow |
+| Method | Path | Removed in | Reason |
+|--------|------|------------|--------|
+| PUT | `/users/hardware/set` | cycle 1 (AZ-197) | hardware-binding feature deleted (no fielded clients in target architecture) |
+| POST | `/resources/check` | cycle 1 (AZ-197) | was the hardware-binding side-effect probe; no remaining purpose |
+| POST | `/get-update` | post-cycle-1 (AZ-183 reverted) | security audit F-1: endpoint disclosed plaintext per-resource encryption keys to any authenticated caller; the underlying installer-distribution flow is itself obsolete |
+| POST | `/resources/publish` | post-cycle-1 (AZ-183 reverted) | same revert as `/get-update` — the publish counterpart of the OTA flow |
+| POST | `/resources/get/{dataFolder?}` | cycle 2 (2026-05-14) | obsolete — per-user encrypted-download flow no longer used by any client; ADR-003 retired |
+| GET | `/resources/get-installer` | cycle 2 (2026-05-14) | obsolete — installer-shipping era is over (browser SaaS + fTPM Jetsons) |
+| GET | `/resources/get-installer/stage` | cycle 2 (2026-05-14) | same as `/resources/get-installer` |
 
 ## Internal Logic
 
@@ -69,7 +71,7 @@ The following endpoints were removed during cycle 1 and now return `404`:
 ### Configuration Sections
 - `JwtConfig` — JWT signing/validation
 - `ConnectionStrings` — DB connections
-- `ResourcesConfig` — file storage paths
+- `ResourcesConfig` — file storage path (`ResourcesFolder`); the installer subfolders were dropped in cycle 2 along with the installer endpoints
 
 ### Kestrel
 - Max request body size: 200 MB (for file uploads)