refactor: split the TUI and refresh project docs

Move login state, authentication, discovery, input, rendering, and tests into focused TUI modules. Add detailed CLI error reports with recovery commands, align the build and host-check documentation, and keep the legacy Go tree outside normal builds.

Checks: make check; make integration-test; go test ./... (legacy/go).

crates/latchd-auth/src/lib.rs

@@ -1,6 +1,6 @@
-//! PAM authentication with one dedicated worker thread.
+//! Authentication worker and session handoff.
 //!
-//! The worker owns all PAM handles. Public tickets contain only an opaque ID.
+//! Keep handles on one thread; public tickets contain only an opaque ID.
 
 use std::{
     collections::HashMap,
@@ -108,7 +108,7 @@ unsafe extern "C" {
     fn pam_strerror(pamh: *const PamHandle, pam_status: c_int) -> *const c_char;
 }
 
-/// An opaque authenticated PAM transaction.
+/// Opaque ticket for an authenticated transaction.
 pub struct AuthTicket {
     id: u64,
     identity: Identity,
@@ -153,7 +153,7 @@ enum Command {
     },
 }
 
-/// Serializes PAM operations on a dedicated worker thread.
+/// Run handle-based operations on one worker thread.
 #[derive(Clone)]
 pub struct AuthService {
     commands: SyncSender<Command>,
@@ -192,10 +192,10 @@ impl AuthService {
         Ok(ticket)
     }
 
-    /// Changes an expired account password through the configured PAM policy.
+    /// Change an expired account password through the configured policy.
     ///
-    /// PAM enforces password strength, history, and token rules.
-    /// Zeroizing buffers hold both passwords and errors never include them.
+    /// The configured policy checks password strength, history, and token rules
+    /// zeroizing buffers hold both passwords.
     pub fn change_password(
         &self,
         username: String,
@@ -218,7 +218,7 @@ impl AuthService {
             .map_err(|_| Error::Worker("PAM worker disconnected".into()))?
     }
 
-    /// Runs the authenticated session and closes its PAM transaction.
+    /// Run the authenticated session and close its transaction.
     pub fn run_session(&self, mut ticket: AuthTicket, spec: SessionSpec) -> Result<(), Error> {
         let (response, result) = sync_channel(0);
         let id = ticket.id;