[cloud-storage] retire legacy storage paths: small-store SQL fallbacks, classic in SaaS, dead tables #7435

Parent: #7419

Context

The four small stores (approvals, devices, notifications, task sources) still keep their legacy SQL code and _legacy_<name> tables for one release after the import (storage/local.rs). In SaaS with no URL, storage::config::mode() falls back to Classic.

Scope

• After the import release has shipped, delete the legacy SQL paths in security/approval/store*.rs, security/devices/store*.rs, desktop/notifications/store*.rs and integrations/task_sources/store*.rs, and drop the _legacy_* tables.
• SaaS mode requires a storage URL: refuse to boot in Classic. Desktop keeps classic as an opt-out until the default flips to sqlite:<workspace>.
• Decide when desktop moves from "no backend" to sqlite:<workspace_dir> by default, so there is a single code path. Plan the migration.

Acceptance criteria

• A SaaS boot with no URL fails with a clear error (test).
• No _legacy_ references left in core.

Verification

Run the affected tests against the memory, sqlite: and mongodb:// drivers (scripts/test-rust-with-mock.sh / pnpm test:rust), plus node scripts/ci/check-storage-bypass.mjs (the baseline must shrink), node scripts/ci/check-feature-forwarding.mjs and pnpm rust:layout. The upstream submodule PR lands first, then the gitlink bump. Existing desktop data needs an import path with a regression test.