Remove operator auth — trust the LAN

Can't log in from a fresh LXC deploy, and the service is LAN-only by
design. Rip out the whole bcrypt-password / signed-cookie session
layer: internal/auth, login templates, gen-admin-password binary +
Makefile targets, auth config block, login/logout routes and the
RequireSession middleware wrap. Agent bearer-token auth on
/api/v1/runs/{id}/* is untouched.

Operators who want a password can front the service with a reverse
proxy — noted in README and docs/operations.md.

internal/httpserver/router.go

@@ -11,12 +11,10 @@ import (
 	"github.com/go-chi/chi/v5/middleware"
 
 	"vetting/internal/api"
-	"vetting/internal/auth"
 	"vetting/internal/web"
 )
 
 type Deps struct {
-	Auth    *auth.Manager
 	UI      *api.UI
 	Agent   *api.Agent
 	LiveDir string // directory containing vmlinuz + initrd.img; "" disables /live
@@ -38,13 +36,8 @@ func NewRouter(d Deps) http.Handler {
 		r.Handle("/live/*", http.StripPrefix("/live/", http.FileServer(http.Dir(d.LiveDir))))
 	}
 
-	// Public (no session required) endpoints.
-	r.Get("/login", d.UI.LoginForm)
-	r.Post("/login", d.UI.LoginSubmit)
-	r.Post("/logout", d.UI.Logout)
-
 	// Agent / PXE endpoints — authenticated per-request by bearer token
-	// or by the unforgeable MAC path parameter, never by the UI session.
+	// or by the unforgeable MAC path parameter.
 	r.Get("/ipxe/{mac}", d.Agent.IPXEScript)
 	r.Route("/api/v1/runs/{id}", func(r chi.Router) {
 		r.Post("/hello", d.Agent.Hello)
@@ -56,20 +49,16 @@ func NewRouter(d Deps) http.Handler {
 		r.Post("/sensor", d.Agent.Sensor)
 	})
 
-	// Session-gated browser UI.
-	r.Group(func(r chi.Router) {
-		r.Use(d.Auth.RequireSession)
-
-		r.Get("/", d.UI.Dashboard)
-		r.Get("/hosts/new", d.UI.NewHostForm)
-		r.Post("/hosts", d.UI.CreateHost)
-		r.Post("/hosts/{id}/delete", d.UI.DeleteHost)
-		r.Post("/hosts/{id}/start", d.UI.StartRun)
-		r.Post("/hosts/{id}/override-wipe", d.UI.OverrideWipeStorage)
-		r.Get("/reports/{runID}", d.UI.Report)
-
-		r.Get("/events", d.UI.SSE)
-	})
+	// Browser UI — no auth; bind to loopback or LAN only, or front
+	// with a reverse proxy if you need a password.
+	r.Get("/", d.UI.Dashboard)
+	r.Get("/hosts/new", d.UI.NewHostForm)
+	r.Post("/hosts", d.UI.CreateHost)
+	r.Post("/hosts/{id}/delete", d.UI.DeleteHost)
+	r.Post("/hosts/{id}/start", d.UI.StartRun)
+	r.Post("/hosts/{id}/override-wipe", d.UI.OverrideWipeStorage)
+	r.Get("/reports/{runID}", d.UI.Report)
+	r.Get("/events", d.UI.SSE)
 
 	return r
 }