Deprecate legacy anti-cheat penalty policy fields

[quan0715]

Context

The anti-cheat runtime has moved away from automatic cumulative penalty locking. Risk events are now recorded with evidence when available, while actionable monitoring failures move the participant to paused and require pre-check. LOCKED is intended to be a TA/manual action path.

The frontend settings UI has removed the visible Penalty Policy section to avoid exposing controls that no longer drive the runtime behavior.

Deprecated / cleanup candidates

• Contest.max_cheat_warnings
• Contest.warning_timeout_seconds
• Contest.allow_auto_unlock
• Contest.auto_unlock_minutes
• API/config response fields that only support the old automatic penalty UI
• i18n/docs copy that describes cumulative violations, warning timeout, auto-lock, or auto-unlock as the normal anti-cheat flow

Proposed follow-up

1. Audit serializer and anticheat-config response usage for these fields.
2. Keep read compatibility where required, but stop presenting them as active policy controls.
3. Decide whether violation_count remains as risk-count/reporting data only.
4. Add a migration plan to drop or rename stale fields after frontend/backend compatibility is confirmed.
5. Update exam consent/report copy to describe: event recording, evidence windows, pause + pre-check, and TA manual lock.

Acceptance criteria

• No admin UI labels the old behavior as Penalty Policy.
• New anti-cheat docs do not claim general violations auto-lock participants.
• Backend fields are either explicitly marked legacy/compatibility or removed through migration.
• Tests cover the current behavior: risk count records, environment failures pause, TA/manual lock remains separate.