Removes old untracked files that were polluting the working tree:

DELETED (5 files):
- db_check.js — standalone pg debug script; hardcodes 5433 and the
  bekind schema. The admin health endpoint renders it obsolete.
- secrets/ — JWK key files; oidcService generates these on demand in dev
  mode; committing keys to git violates the security rule in commit.md.
- sql/migrations/038-drop-bekind-facility-tables.sql — drops tables from
  the bekind/captaincare codebase (residuals from the old template).
- src/oidc/jwksService.ts — duplicate JWKS logic; oidcService.ts already
  implements key generation and caching; importing this would be a breaking
  change to the existing adapter.
- src/oidc/views/check-email.hbs — not referenced anywhere in the codebase;
  the registration flow renders verify-pending.hbs instead.

STAGED FOR ADD (12 files, all clean under tsc --noEmit):
- sql/migrations/037-*.sql — project_db_connections + user_app_mappings schema
  needed for Phase 3 multi-project SSO integration (PLANS.md §2 Phase 3).
- sql/migrations/039-*.sql — OIDC grants indexes (performance) required by
  oidcAdapterService lookups.
- src/contracts/admin/* — Zod schemas (CreateClientSchema, UpdateClientSchema
  etc.) consumed by all admin controllers already present in the codebase.
- src/contracts/oidc/* — OpenAPI schemas for OIDC token responses and
  paths consumed by the Swagger generator.
- src/controllers/admin/* — 7 admin controller files (clients CRUD,
  db-connections CRUD+test, health check) for the admin API surface.
- src/middlewares/admin-api-key.ts — X-Admin-Api-Key guard used by all
  admin controllers.
- src/models/Client.ts — Sequelize model for oidc_clients table; imported
  by init-models.ts and used by adminService.ts.
- src/providers/ClientProvider.ts — data-access layer for oidc_clients;
  used by AdminDbConnectionService in adminService.ts.
- src/services/admin/* — AdminDbConnectionService (CRUD for project DB
  connections) and ProjectUserReaderService (cross-project user lookup)
  consumed by admin routes and Phase 3 (PLANS.md).
- src/types/* — TypeScript declarations for oidc-provider and express
  extended types.

Working tree is now clean (guidelines/ and postman/ are tracked, unchanged).
tsc --noEmit exit 0 — no new errors introduced.
Co-authored-by: Cursor <cursoragent@cursor.com>