Fixed 5 instances of a dead hardcoded admin token across android.html, win/server/android-scripts.php, COMMANDS-30.php, and factory-api.php. Genuinely removed 26+ confirmed-dead files (toolbox scratch scripts, temp/ pre-migration archives, internal trash folders) via server-side unlink/rmdir after preserving each to Trash first, not just content-stubbing.