Resolve the mechanical findings F68-F73 and F76

[gerwaric]

Resolves the seven mechanical open findings from the shop write-path and credential-custody investigations, plus two build fixes discovered while validating them.

Findings sweep (F68-F73, F76)

• F68: delete the dead src/poe/endpoints/website/ directory (no includers anywhere; two headers defined types under filenames that promised something else) and its CMakeLists.txt entries.
• F69: delete the dead Shop::StashesIndexed signal declaration.
• F70: reword the "Failed to find item" recovery advice in Shop::OnShopSubmitted — it pointed at a Shop menu action that no longer exists; the recovery is simply resubmitting.
• F71: mask the bearer token in NetworkManager::createRequest's trace log, matching how setPoeSessionId masks POESESSID.
• F72: fix the Authorization mask in NetworkManager::logHeaders to compare the header name instead of the "request"/"reply" label, so it can actually fire.
• F73: keep glz::format_error's buffer context out of log lines whose source buffer can carry a token — OAuthManager::receiveToken formats the error without the buffer, and read_json gains a buffer_may_hold_credentials flag (set by readOAuthToken) that logs the error code and byte position only. (This glaze version exposes the position as error_ctx::count, not location.)
• F76: delete the dead OAuthManager::m_authenticated / isAuthenticatedChanged and the never-connected LoginDialog::OnSessionIDChanged.

docs/cleanup/findings.md moves the six entries to the resolved ledger per the register's convention; F74, F75, and F77 stay open (F74's opener now names the credential-custody investigation directly since it no longer follows F71-F73).

Build fixes (separate commit)

• Copy the crashpad handler from $<TARGET_FILE:crashpad_handler> instead of a hardcoded single-config path, with an explicit add_dependencies. Multi-config generators (the Visual Studio default a plain cmake -S . -B build picks on Windows) put the handler under a per-config subdirectory, which broke the POST_BUILD copy. Under Ninja the expression resolves to the same path CI uses today.
• On Windows, prepend Qt's bin directory to the tests' PATH via ENVIRONMENT_MODIFICATION, so ctest --test-dir build works from a plain shell instead of failing with 0xc0000135. CI already has Qt on PATH (install-qt-action), where the prepend is a no-op.

Verification

• Built with the Visual Studio generator against Qt 6.11.1 on Windows; full suite passes (35/35), including from a shell with no Qt directory on PATH.
• The crashpad fix was verified by deleting the handler from the old expected path and rebuilding — the copy now resolves the per-config location.

🤖 Generated with Claude Code

[aurokin]

Seems like a solid cleanup! Good dead code removal and build portability / windows stuff