meteor3: purge dead client packages — web UI renders on 3.1

alanning:roles removed (client crashed the whole bundle; plain user.roles
checks instead), selaias:cookie-consent replaced by in-repo React banner,
publish-performant-counts vendored with countAsync, Meteor.autorun dropped
(App)/Tracker.autorun (FiresMap), and the map publications not covered by
the REST smoke (activefiresmyloc, activefiresunionmyloc, fireAlerts,
oauth.verifyConfiguration) converted to async APIs.

Verified in browser: / and /fires render with map + cookie banner, zero
uncaught exceptions. REST smoke byte-identical (12/12).

UPGRADE.md

@@ -251,6 +251,31 @@ MONGO_CONTAINER=tcef-mongo7 MONGO_SHELL=mongosh MONGO_PORT=27019 ./smoke/smoke.s
   `WebApp.connectHandlers` handler serving the same static page list (the
   per-fire section of the old handler was behind `firesMapEnabled = false`,
   i.e. dead code, and was dropped). Verified serving on dev.
+- ✅ **Dead client packages purged — the web UI now RENDERS on Meteor 3.**
+  First-ever browser verification of this branch (the smoke only covers REST)
+  found a chain of ancient Blaze-era packages whose client code threw at
+  bundle load, killing the whole app (`meteorInstall is not defined`):
+  - **alanning:roles 1.2.10** (client crash, and its server
+    `Roles.userIsInRole` is sync) → package removed; the app barely used it:
+    `facts.js` now checks the plain `user.roles` field (admin set cached at
+    startup) and App.js takes `roles` from the user doc (prop was unused).
+    Upgrading to roles v4 was rejected: needs a prod data migration.
+  - **selaias:cookie-consent** (its `Cookies` global is gone) → removed;
+    replaced by in-repo React `imports/ui/components/CookieConsent` reusing
+    the same i18n keys; `CookieConsent.init` dropped from `i18n.js`.
+  - **natestrauser:publish-performant-counts** server `Counter._publishCursor`
+    uses sync `cursor.count()` → **vendored** as
+    `packages/publish-performant-counts` (`tcef:publish-performant-counts`)
+    with `countAsync` and an async-aware interval; same public API.
+  - `Meteor.autorun` (removed in Meteor 3) → dropped (App.js debug) /
+    `Tracker.autorun` (FiresMap).
+  - Map/server publications not exercised by the REST smoke converted to
+    async: `activefiresmyloc`, `activefiresunionmyloc`, `fireAlerts`
+    (countAsync/fetchAsync/awaited firesUnion), and `oauth.verifyConfiguration`
+    (findOneAsync). `migrations.js` bodies stay sync **by design** (control is
+    pinned at v18; prod data arrives pre-migrated) — tracked as debt.
+  Verified in a real browser: `/` and `/fires` render (map, search, layers,
+  cookie banner), zero uncaught exceptions; REST smoke byte-identical.
 
 ### Still TODO before the web (not just REST) is fully deployable on 3.x
 - **React 16 → 18** render root + verify ancient react-* libs.