Remove external CMS fallbacks from Payload migration

[jmgasper]

Summary

• route legacy CMS compatibility reads and article votes exclusively through approved Topcoder Payload hosts, failing closed when configuration is incomplete
• resolve legacy asset routes through Payload and allow redirects only to the configured S3-backed asset origin
• keep CMS clients server-side, scan source/build/runtime responses for retired provider authorities, and move application-owned routes ahead of the generic CMS lookup
• restore linked-entry resolution and apply bounded Payload request timeouts before release
• preserve the Zurich/Comcast retirement already present on develop

Compatibility route and environment-variable names remain temporarily for existing callers, but this change removes outbound Contentful, Netlify, Octana, and ctfassets targets.

Validation

• npm test — 164 suites passed / 4 skipped; 431 tests passed / 23 skipped
• focused CMS regression matrix — 4 suites, 51 tests passed
• npm run lint — passed
• npm run build — passed
• npm run verify:no-retired-cms-targets — passed
• git diff --check — passed