cleanup(cli): remove the profile-json config entry

`./.dsh-tmp-profile/config.json` was the web config-tree boot's user-config
plane, but never gained a writer: no production code created or edited it, no
test exercised it, and no user documentation named it. The fields it mapped
have owners elsewhere — provider/model are the api-gateway's default route and
persistenceRoot is an assembly fact, while typed user preferences live in
$DSH_HOME/settings.yaml.

Delete PROFILE_DIR, PROFILE_FILE, ProfileMapping, PROFILE_MAPPINGS, and
readProfile() with the patch source that consumed them. AppCLIEntry now
composes patches from CLI flags and the resolved frontend distIndex only; the
surrounding layers are unchanged. A file on disk is ignored completely — no
migration, replacement format, or deprecation diagnostic, per the pre-release
stance.

apps/cli/config/web.cordis.yml

@@ -1,6 +1,6 @@
 # `dsh web` — the browser surface, as a patch list over `base.cordis.yml`.
 # The launcher includes the base and applies this file, then any `--config`
-# overlay, then AppCLIEntry's profile-json and CLI-flag patches, as sibling patch
+# overlay, then AppCLIEntry's CLI-flag patches, as sibling patch
 # lists at ONE include level: patches never cross an include boundary, so
 # stacking overlays as nested includes would silently stop reaching base rows.
 #
@@ -81,8 +81,8 @@
       name: '@deepseek-ai/dsh-host-directory-picker-auto'
 
     # The API gateway: the transport-agnostic dispatch face every client shape
-    # shares. provider/model are the host default routing — the profile json's
-    # mapping target (user config overrides these engineering defaults).
+    # shares. provider/model are the host default route for created and resumed
+    # agents; a session's own picker overrides it per agent.
     - id: api-gateway
       name: '@deepseek-ai/dsh-host-apiproxy'
       config: