comprehensive-test.js and test-security-fixes.js are 875 lines of ad-hoc security test scripts (not Jest tests). They have zero references in code or docs. Moved to scripts/legacy/ to declutter repo root without losing the content. All 759 Jest tests still pass.