Sanitize codebase, reorganize docs, and add missing deploy files

Remove dead code identified in docs/SANITIZATION-REVIEW.md:
- app/blueprints/content_old.py and app/blueprints/playlist.py
- app/models/group.py, app/utils/nginx_config_reader.py
- orphaned templates (content_list, edit_content, upload_content,
  player_page) and the related group/Template references

Result: 6 blueprints, 82 routes, no dead modules or orphan templates.

Add files that deploy.sh and docker-entrypoint.sh already require but
which were never tracked:
- https_manager.py       (referenced by deploy.sh, migrate_network.sh,
                          docker-entrypoint.sh)
- Caddyfile.example      (seeded by deploy.sh; its absence aborts deploy)

Relocate generated Graphify artifacts from graphify-out/ to
docs/graphify-out/ (110 files, no content change) and archive the
superseded docs under docs/.

Ignore hygiene:
- ignore ad-hoc .env backups (.env.bak*) — they contain live secrets
- keep the pre-sanitization snapshots (docs/legacy code/,
  docs/old_code_documentation/) on disk but out of the repo

Fix .env.example: drop a duplicated config block, genericize the
hardcoded host IP, and document HOSTNAME_INTERNAL.

docs/tools/verify_dockerignore.py

@@ -0,0 +1,55 @@
+"""Verify 'legacy code' is excluded from the Docker build context.
+
+Docker's .dockerignore semantics (as applied by BuildKit):
+  * 'legacy code/'     -> directory named "legacy code" at the context root
+  * '**/legacy code/'  -> directory named "legacy code" at ANY depth
+
+This simulates a walk of the build context and asserts the snapshot never
+appears in the files that would be sent to the daemon.
+"""
+import os
+
+ROOT = os.getcwd()
+
+rules = []
+for raw in open('.dockerignore', encoding='utf-8'):
+    line = raw.strip()
+    if line and not line.startswith('#'):
+        rules.append(line)
+
+print('rules mentioning legacy:', [r for r in rules if 'legacy' in r])
+
+
+def is_legacy_dir(rel):
+    """True if *rel* is a directory named 'legacy code' at root or any depth."""
+    return rel == 'legacy code' or rel.endswith('/legacy code')
+
+
+excluded, included = [], []
+for dirpath, dirnames, filenames in os.walk(ROOT):
+    dirnames[:] = [d for d in dirnames if d != '.git']
+    for d in list(dirnames):
+        rel = os.path.relpath(os.path.join(dirpath, d), ROOT)
+        if is_legacy_dir(rel):
+            excluded.append(rel + '/  (pruned)')
+            dirnames.remove(d)
+            continue
+    for f in filenames:
+        rel = os.path.relpath(os.path.join(dirpath, f), ROOT)
+        parts = rel.split('/')
+        under_legacy = any(is_legacy_dir('/'.join(parts[:i]))
+                           for i in range(1, len(parts) + 1))
+        (excluded if under_legacy else included).append(rel)
+
+print()
+print('EXCLUDED (legacy snapshot):')
+for e in sorted(excluded)[:5]:
+    print('   -', e)
+print(f'   ... {len(excluded)} total')
+print()
+leak = [i for i in included if 'legacy code' in i]
+print(f'files reaching the build context: {len(included)}')
+print('LEAKED:', leak if leak else 'none')
+assert not leak, 'legacy snapshot would ship into the image!'
+print()
+print('VERIFIED: legacy snapshot is excluded from the Docker build context')