device-key: clean up unused crate

[euroelessar]

Why

The device-key implementation is no longer used, but it still leaves behind a standalone crate plus app-server RPC, schema, state, and test surface area. Keeping that dead surface in the tree increases maintenance cost and makes the active remote-control protocol harder to read.

What changed

• removed the unused codex-device-key crate and workspace dependency
• removed the device/key/* app-server RPCs, request handling, tests, and generated schema artifacts
• removed the now-dead state runtime bindings while preserving the historical SQL migration so existing state DB upgrade history stays intact
• moved the still-live remote-control status notification types into a dedicated remote_control protocol module
• updated app-server/README.md to drop the removed APIs

Validation

• git diff --check
• attempted cargo test -p codex-app-server-protocol and cargo test -p codex-app-server, but both were blocked in this environment by the pinned crossterm git dependency fetch returning HTTP 403
• attempted to refresh generated fixtures through the normal schema generator path, but the local just version is too old for this repo's justfile; the checked-in generated artifacts were updated to match the removed source surface