LaneDNS: clean up leftovers (orphan tool dirs, duplicate local stats, Safe Browsing key in OMA)

Imported from GitHub issue El-SaMa/oma#216 by @El-SaMa.

• Orphan tool folders not in the registry: site/tools/a-record, site/tools/cron-tester, site/tools/web-ssh (the last two redirect): remove or 301 them.
• Local stats now duplicate OMA: includes/internal-stats.php (SQLite hits) and api/tool-stat.php (popular chips). Keep popular chips (could read from OMA usage later), retire the SQLite page-view log once OMA usage is trusted, and delete storage/internal-stats.sqlite with operator OK.
• Arx Site Check reads an optional safe_browsing_api_key from storage/app.secrets.php; move it to OMA settings (lanetti_tools.settings, entered in a Settings modal, never shown inline) and pass it through the config pull.
• Old backups on nilek from 2026-10-14 deploys: /root/lanedns-backup-*.tgz, /root/lanedns-ptr-backup-*.tar, /root/lanedns-fix2-backup-*.tar, /root/lanedns-admin-removed-*: delete after a week if the site is fine.

Context (2026-10-14): lanedns.lanetti.fi (Lanetti Tools, standalone PHP site on nilek, repo El-SaMa/lanedns site/) was revamped and OMA became its control plane: usage in /admin/tools/usage, settings in /admin/tools/settings, staff MCP oma.admin_lanetti_tools, config pull GET /api/lanetti-tools/config (link token in LaneDNS storage/oma-link.php). Events: site_events site lanedns.lanetti.fi, tool_run sanitized by services/core-api/src/lanetti-tools/usage-events.ts. Read handbook hosting/netspeed section "OMA is the control plane" and .cursor/rules/lanedns-standalone.mdc (deploy recipe: keep public_html group www-data) before touching LaneDNS.