Phase 3: remove legacy dual paths and release v3.0.0

[olliethedev]

Context

Final phase of the v3.0.0 core simplification, after all plugin sweeps in #136 land. v3.0.0 is not yet published to npm, so all breaking removals batch into this release. This PR should be reviewable as "deletions only" — no migrations happen here.

During phases 1–2 the old and new paths coexist so main stays green; this issue deletes the old paths.

Deletion checklist

Provider / context:

• Remove Link / navigate / refresh / Image / apiBaseURL / apiBasePath fields from all plugin override types (top-level router + api from Top-level router adapter on StackProvider (framework presets for Link/navigate/refresh/Image) #127 become the only path)
• Remove the per-plugin override precedence / fallback branches in StackProvider
• Remove onBefore*PageRendered guard callback types and their hook shims (auth provider route gating from Auth provider contract: centralized identity + permissions (getIdentity/can) across client and backend #128 becomes the only path)
• Remove manual identity props (currentUserId, headers, loginHref) from CommentThread and any other components that took them (identity comes from Auth provider contract: centralized identity + permissions (getIdentity/can) across client and backend #128's provider)

Templates / examples:

• Codegen templates (scripts/codegen/files/*) use only the new setup (entry factories Framework entry factories: collapse page handler and API route setup to one-liners #130, top-level providers); delete old-style layout/page-handler templates
• Playground and docs examples updated to new-only

Tests:

• Delete E2E/unit tests that exercise removed paths; verify new-path coverage is complete across all three frameworks

Docs:

• Rewrite installation guide against factories/providers only (manual glue moves to an "advanced" appendix or is dropped)
• Update all plugin MDX pages (override tables, auth examples)
• Write v2 → v3 migration guide in docs/content/docs/breaking-changes.mdx covering: yar route context (already documented), removed override fields, removed guard callbacks, removed identity props, new provider setup
• Update agent skills (btst-client-plugin-dev, btst-integration, btst-build-config) to new patterns

Verification / release:

• rg sweep: no references to removed fields/props/callbacks anywhere in the monorepo
• pnpm build && pnpm typecheck && pnpm lint && pnpm test green; all three codegen E2E suites green
• Publish @btst/stack 3.0.0 to npm (gate: everything above complete)

Depends on

• Phase 2: per-plugin adoption sweep of the new core primitives #136 (all plugin sweeps merged)
• All phase-1 core issues closed: Auth provider contract: centralized identity + permissions (getIdentity/can) across client and backend #128, Internal resource-hook factory: deduplicate query-keys/hooks boilerplate across plugins #129, Notification provider: pluggable notify() instead of hardcoded sonner toasts in every plugin #131, i18n provider: translatable plugin UI strings with English defaults #132, URL-synced list state: filters, tabs, and pagination survive refresh, back button, and sharing #133

[olliethedev]

Stable v3 release and installation verification complete

All five closeout waves are complete, including the stable package cohort and the RC3-derived production application migration.

Published stable cohort

• @btst/stack@3.0.0 — latest=3.0.0; source/main 32e9f36cbb2b57cd622f0ecb3e23d568c960b8e7; release; trusted publish.
• @btst/codegen@0.2.0 — latest=0.2.0; same tag/source and provenance.
• @btst/better-auth-ui@2.0.0 — latest=2.0.0; source 13fc509b9862f8df69629aa9e851097474e161e5; release; trusted publish.
• All three public artifacts expose SLSA provenance and tag-matched gitHead metadata.

Release gates

• Main CI passed.
• All-framework Codegen E2E passed for Next.js, React Router, and TanStack.
• Clean public-registry Next.js installs passed under npm and strict pnpm, resolving Stack 3.0.0, Codegen 0.2.0, Better Auth UI 2.0.0, the retained adapter 2.2.3 cohort, and one exact Better Auth/Core 1.6.16 type universe; both optimized production builds passed.
• Public Codegen generated the stable Drizzle schema with delegated @btst/cli@2.2.4; the known generated schema hash is fb1d5743181ca95664e39df627dd2d3f6c8e255ef908772d07c7ad7c03622c35.

RC3-derived production installation

• better-stack-web#38 landed the migration-first database change; production migration workflow 33459544152 passed.
• better-stack-web#39 selectively ported the reviewed RC3 runtime work onto migrated main and replaced the RC graph with the exact stable cohort.
• better-stack-web#40 fixed the only deployment-verification finding: a homepage text-node hydration mismatch.
• Final production source is 9f02a1c2751383786ee151d26526beb912087c93; Vercel production deployment 6193275958 completed successfully.
• Fresh isolated production-browser checks passed for /, /plugins, /docs, /playground, /chat, /p/blog, the representative blog post, sign-in, and the anonymous media-library protection redirect. Every session reported zero JavaScript errors and no Next overlay.
• The representative blog hero completed through Next Image with sizes="(max-width: 1024px) 100vw, 896px", client width 896, and natural width 895.
• A pre-existing, non-visible docs segment-prefetch 404/fallback was separated as better-stack-web#41; direct docs routes and ordinary RSC navigation return 200, so it is not a v3 regression or release blocker.

A new privileged live-Blob mutation was not claimed: this environment has no production deployment session/database credential, and the available local Neon credential was proven to target a different database. The attempted identity was stopped before upload and fully cleaned up. Stable media behavior remains covered by the release tests and prior real-Blob RC application validations; the deployed anonymous protection boundary was reverified.

All dependencies and follow-up release tickets are closed. The parent checklist is updated and this issue is ready to close.