Retired Companion routes answer 422 instead of 410 #664

Eleven of the retired Companion routes in backend/api/v1/api.py answer 422 instead of the 410 that docs/SECURITY.md promises. retired_companion_routes takes **_: str, and FastAPI reads that as a required query parameter named _, so GET /api/v1/login/companion-events gets {"loc": ["query", "_"], "msg": "Field required"} and only ?_=1 gets the 410. FastAPI 0.146.0 and 0.161.1 behave the same, so it predates #648. No credentials are issued either way, and /companion/{legacy_path:path} is fine.

Dropping **_ from the signature fixes it, since the handler reads nothing. A test that calls each retired path and expects 410 would keep it fixed.

Either