chore(zero-trust): cleanup, server-computed site labels, run-targets region-filter fix

[guohai]

Cleanup pass over the zero-trust/geoip surfaces plus two functional improvements that fell out of it.

What

• Server-computed siteLabel on GET /api/eval-agents and GET /api/eval-agent-tokens ("Santa Clara 01"), reusing the existing regionMetadata helper — one catalog fetch per request, no per-row queries. The console renders it directly, eliminating the brief raw-siteId flash when a freshly-detected city isn't in the client's cached catalog yet (the server just created the row; it always knows the name).
• run-targets regression fix: the mine list's ?region= filter matched eval_agent_tokens.region — permanently NULL for non-public tokens since zero-trust — so selecting a region emptied the list (hit by run-your-own). The filter now matches the effective (detected) region, with a both-directions test.
• Dead code/comments removed (each grep-verified): stale ">24h" comment after the 2h re-check change, changelog-style history in the LOCATION_RECHECK_HOURS comment, the unread count(*) field in getAvailableRegions, and the caller-less getPendingEvalJobsByRegion.

Verification

• Targeted suites 152+ tests green (location, geoip-refresh, zero-trust-region-api incl. new filter + siteLabel cases, zero-trust-metrics, run-picker, regions, tier-pool-dispatch, site-id-wire); npm run check clean; eslint unchanged.
• Independent review: approved, zero issues (all five named risks verified clean, incl. wire-contract compatibility and no-per-row-DB-calls).

Generated with SMT smt@agora.build