Remove operator auth — trust the LAN

Can't log in from a fresh LXC deploy, and the service is LAN-only by
design. Rip out the whole bcrypt-password / signed-cookie session
layer: internal/auth, login templates, gen-admin-password binary +
Makefile targets, auth config block, login/logout routes and the
RequireSession middleware wrap. Agent bearer-token auth on
/api/v1/runs/{id}/* is untouched.

Operators who want a password can front the service with a reverse
proxy — noted in README and docs/operations.md.

internal/api/ui_handlers.go

@@ -11,7 +11,6 @@ import (
 	"github.com/go-chi/chi/v5"
 	"gopkg.in/yaml.v3"
 
-	"vetting/internal/auth"
 	"vetting/internal/events"
 	"vetting/internal/model"
 	"vetting/internal/orchestrator"
@@ -23,7 +22,6 @@ type UI struct {
 	Hosts     *store.Hosts
 	Runs      *store.Runs
 	Artifacts *store.Artifacts
-	Auth      *auth.Manager
 	EventHub  *events.Hub
 	Runner    *orchestrator.Runner
 	Tiles     *TileEnricher
@@ -93,38 +91,6 @@ func (u *UI) StartRun(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/", http.StatusSeeOther)
 }
 
-func (u *UI) LoginForm(w http.ResponseWriter, r *http.Request) {
-	next := r.URL.Query().Get("next")
-	if next == "" {
-		next = "/"
-	}
-	_ = templates.Login("", next).Render(r.Context(), w)
-}
-
-func (u *UI) LoginSubmit(w http.ResponseWriter, r *http.Request) {
-	if err := r.ParseForm(); err != nil {
-		http.Error(w, "bad form", http.StatusBadRequest)
-		return
-	}
-	password := r.PostForm.Get("password")
-	next := r.PostForm.Get("next")
-	if next == "" || !strings.HasPrefix(next, "/") {
-		next = "/"
-	}
-	if !u.Auth.VerifyPassword(password) {
-		w.WriteHeader(http.StatusUnauthorized)
-		_ = templates.Login("Invalid password.", next).Render(r.Context(), w)
-		return
-	}
-	u.Auth.Issue(w, r)
-	http.Redirect(w, r, next, http.StatusSeeOther)
-}
-
-func (u *UI) Logout(w http.ResponseWriter, r *http.Request) {
-	u.Auth.Clear(w)
-	http.Redirect(w, r, "/login", http.StatusSeeOther)
-}
-
 func (u *UI) NewHostForm(w http.ResponseWriter, r *http.Request) {
 	_ = templates.Registration(templates.RegistrationForm{}).Render(r.Context(), w)
 }