Remove the v1 user routes and keep complete simulation and report results final #4028

The 2026-10-22 security review of the deployed API found two authorization gaps in v1 routes.

1. Legacy user routes. /{country_id}/user-profile (GET, POST, PUT) and /{country_id}/user-policy (GET, POST, PUT) read and change user profiles and saved policies by a user_id, auth0_id or record id taken from the request, and check no credential. App v2 does not call them, and Remove the routes only the legacy site used, check health at /health, and stop serving Canada, Nigeria and Israel #4017 reports no production requests to them in the 30 days to 2026-10-19. Signed-in users' saved work is served by the /v2 routes, which take the owner from the verified credential.
2. Result updates. PATCH /{country_id}/simulation and PATCH /{country_id}/report take no credential and can replace a result that is already complete. These records are shared (identical requests reuse one record), so one caller's update changes what every viewer of that record sees.

Plan:

• Remove the v1 user routes. Remove the routes only the legacy site used, check health at /health, and stop serving Canada, Nigeria and Israel #4017 removes them too, but it is held for the legacy site's shutdown because of the other routes it removes.
• Make a complete result final: an update that repeats it is accepted and changes nothing, and one that would change it answers 409. Today the browser that ran the calculation writes its result, so there is no compute-worker credential to require; making the server the only writer of results is a follow-up.