escala 2+3: Meteor 1.8.3 -> 2.3 (Mongo 3.2 compatible), dead-package remediation

Reaches Meteor 2.3 building + running against Mongo 3.2, REST smoke test
byte-identical to the 1.6.1.1 baseline (all 12 Flutter endpoints green).

Dead/abandoned Atmosphere packages removed or replaced (the upgrade blockers):
- arkham:comments-ui (no Meteor 2.x build; pinned accounts-password@1.x):
  reimplemented the fire-page comments as a React feature:
    imports/api/Comments/ (collection, server methods, publication, media
    analyzers, new-fire-comment email) + imports/ui/components/Comments/CommentsBox.
    Comment text now rendered as safe plain text + image/youtube embed (was
    markdown-to-HTML). Wired into Fires.js; sitemaps.js + migration v11 updated
    to the new collection. Old Blaze/startup comments files deleted.
- nimble:restivus (REST API; pinned accounts-password@1.3.3, CoffeeScript source
  that crashes this build host): vendored as a local package
  packages/nimble-restivus with the .coffee precompiled to plain JS and the
  accounts-password constraint loosened to 2.x. REST behavior unchanged
  (verified by smoke test). This also dropped the entire iron:router stack.
- maximum:server-transform (+ peerlibrary:*, meteorhacks:zones/inject-initial):
  unused; removal broke Meteor.publishTransformed in FalsePositives publications
  -> replaced with plain Meteor.publish (no transform was configured).
- less, markdown (no source files), and the dead test stack
  (meteortesting:mocha, practicalmeteor:chai, xolvio:cleaner) which transitively
  pulled coffeescript@1.0.17 — the build plugin that crashed meteor-tool
  (node_contextify assertion) on this machine. Removing it unblocked the build.
- fourseven:scss 4.5.4 -> 4.14.1 (node-sass 4.5.3 doesn't build on node 12).

npm-mongo driver at 2.3 is 3.9.x — still compatible with the production Mongo
3.2 replica set.

packages/nimble-restivus/package.js

@@ -0,0 +1,34 @@
+Package.describe({
+  name: 'nimble:restivus',
+  summary: 'Create authenticated REST APIs in Meteor via HTTP/HTTPS. (Vendored fork: precompiled JS, accounts-password 2.x compatible.)',
+  version: '0.8.12',
+  git: 'https://github.com/kahmali/meteor-restivus.git'
+});
+
+/*
+ * Vendored fork of nimble:restivus@0.8.12.
+ *
+ * Why: the published Atmosphere package pins accounts-password@1.3.3, which
+ * conflicts with Meteor 2.x (accounts-password 2.0). The upstream source is
+ * CoffeeScript, and the coffeescript build plugin crashes this build machine
+ * (node_contextify assertion). So the .coffee sources were precompiled to plain
+ * JS (lib/restivus-all.js) and this package.js drops the coffeescript build
+ * dependency and loosens the accounts-password constraint to 2.x.
+ *
+ * The REST behavior is unchanged — verified by the REST smoke test.
+ */
+Package.onUse(function (api) {
+  api.versionsFrom('METEOR@2.3');
+
+  api.use('check');
+  api.use('underscore');
+  api.use('accounts-password@2.0.0');
+  api.use('simple:json-routes');
+
+  // iron-router error helper defines the `ironRouterSendErrorToResponse` global
+  // used by the routes, so it must load first.
+  api.addFiles('lib/iron-router-error-to-response.js', 'server');
+  api.addFiles('lib/restivus-all.js', 'server');
+
+  api.export('Restivus', 'server');
+});