Remove dead code left after the security fixes #446

Summary

The security fixes left two pieces of dead code. Removing them stops a future change from reviving a closed path by accident.

• Severity: none (hygiene)
• Area: webapp API wrappers, .env.example
• Source: follow-ups from Carry the production function revokes in the Supabase migrations #397 and Keep server secrets out of the webapp and admin-dashboard containers #403

Where

• apps/webapp/src/api/rpc/createDirectMessageChannel.ts and its re-export at apps/webapp/src/api/rpc/index.ts:2. The RPC is service-role only since Carry the production function revokes in the Supabase migrations #397, and no code imports the wrapper.
• .env.example:344 — NEXT_PUBLIC_ELASTIC_APM_SECRET_TOKEN=. No code reads it. The NEXT_PUBLIC_ prefix would inline a secret into the client bundle the day code reads it (same reason Keep server secrets out of the webapp and admin-dashboard containers #403 removed NEXT_PUBLIC_SPACES_SECRET).

Fix plan

1. Delete createDirectMessageChannel.ts and its line in apps/webapp/src/api/rpc/index.ts.
2. Delete the NEXT_PUBLIC_ELASTIC_APM_SECRET_TOKEN line. If NEXT_PUBLIC_ELASTIC_APM_SERVER_URL (:343) also has no reader, delete it too.

Acceptance criteria

• grep -rn "createDirectMessageChannel\|ELASTIC_APM" apps packages returns nothing.
• bun run --filter @docs.plus/webapp typecheck and lint pass.