Remove operator auth — trust the LAN

Can't log in from a fresh LXC deploy, and the service is LAN-only by
design. Rip out the whole bcrypt-password / signed-cookie session
layer: internal/auth, login templates, gen-admin-password binary +
Makefile targets, auth config block, login/logout routes and the
RequireSession middleware wrap. Agent bearer-token auth on
/api/v1/runs/{id}/* is untouched.

Operators who want a password can front the service with a reverse
proxy — noted in README and docs/operations.md.

internal/web/templates/layout.templ

@@ -20,9 +20,6 @@ templ Layout(title string) {
 				</nav>
 				<div class="session">
 					<span class="heartbeat" hx-ext="sse" sse-connect="/events" sse-swap="heartbeat">·</span>
-					<form method="post" action="/logout" class="logout-form">
-						<button type="submit">Log out</button>
-					</form>
 				</div>
 			</header>
 			<main>