fix: remove the fragmentation handling stranded by #1303

#1298 and #1303 merged together. #1298 taught the creation paths to
resolve a fragmentation_level default; #1303 removed everything that
consumed it. Neither conflicted textually, so main ended up validating
the field on create and update, copying it on duplicate, resolving
default_fragmentation_level for it, and advertising it in the v1 API
docs — for a value nothing reads and a setting the Image Security tab no
longer exposes.

Inert rather than broken, which is exactly why it needed removing on
purpose: dead code that contradicts the PR that just deleted the feature
is how the next reader concludes fragmentation still works.

The events.fragmentation_level column and the app_settings row stay, as
#1303 decided — dropping a column is irreversible and the stored values
are harmless once nothing reads them.

Refs #1300

backend/__tests__/integration/imageSecurityDefaults.test.js

@@ -5,7 +5,7 @@
  * rendered as toggles, and read by nothing:
  *
  *   default_protection_level, default_image_quality,
- *   enable_canvas_rendering, default_fragmentation_level
+ *   enable_canvas_rendering
  *
  * Each maps onto an `events` column migration 038 already created, and each
  * is labelled "… by default". `enable_devtools_protection` was the only one
@@ -46,7 +46,7 @@ describe('image-security creation defaults', () => {
   beforeEach(async () => {
     await db('app_settings').whereIn('setting_key', [
       'default_protection_level', 'default_image_quality',
-      'enable_canvas_rendering', 'default_fragmentation_level',
+      'enable_canvas_rendering',
     ]).del();
   });
 
@@ -60,13 +60,11 @@ describe('image-security creation defaults', () => {
     await setSetting('default_protection_level', 'enhanced');
     await setSetting('default_image_quality', 72);
     await setSetting('enable_canvas_rendering', true);
-    await setSetting('default_fragmentation_level', 5);
 
     expect(await getImageSecurityDefaults()).toEqual({
       protection_level: 'enhanced',
       image_quality: 72,
       use_canvas_rendering: true,
-      fragmentation_level: 5,
     });
   });
 
@@ -83,7 +81,6 @@ describe('image-security creation defaults', () => {
     ['image quality above 100', 'default_image_quality', 250],
     ['image quality of zero', 'default_image_quality', 0],
     ['a non-numeric quality', 'default_image_quality', 'high'],
-    ['fragmentation above the range', 'default_fragmentation_level', 99],
     ['a non-boolean canvas value', 'enable_canvas_rendering', 'yes'],
     // parseInt would have rescued each of these into a valid-looking
     // integer. The settings PUT stores values without validating them, so
@@ -91,8 +88,6 @@ describe('image-security creation defaults', () => {
     ['a numeric prefix with trailing junk', 'default_image_quality', '72oops'],
     ['a fractional quality', 'default_image_quality', 72.5],
     ['a single-element array', 'default_image_quality', [72]],
-    ['a fractional fragmentation level', 'default_fragmentation_level', 3.7],
-    ['a fragmentation level with trailing junk', 'default_fragmentation_level', '3x'],
   ])('ignores %s and falls through to the column default', async (_label, key, value) => {
     await setSetting(key, value);
     expect(await getImageSecurityDefaults()).toEqual({});
@@ -210,11 +205,10 @@ describe('image-security creation defaults', () => {
     it('resolves each column independently', () => {
       expect(resolveImageSecurityColumns(
         { image_quality: 60 },
-        { protection_level: 'enhanced', fragmentation_level: 4 },
+        { protection_level: 'enhanced' },
       )).toEqual({
         protection_level: 'enhanced',
         image_quality: 60,
-        fragmentation_level: 4,
       });
     });
 

backend/__tests__/routes/adminEvents.smoke.test.js

@@ -224,7 +224,6 @@ describe('admin events CRUD endpoints (smoke)', () => {
       ['image_quality', [72]],
       ['protection_level', ['basic']],
       ['use_canvas_rendering', [false]],
-      ['fragmentation_level', [3]],
       // Not a protection field: the guard is not scoped to that block.
       ['event_name', ['Arrayed']],
       ['allow_downloads', [false]],