refactor: split the TUI and refresh project docs

Move login state, authentication, discovery, input, rendering, and tests into focused TUI modules. Add detailed CLI error reports with recovery commands, align the build and host-check documentation, and keep the legacy Go tree outside normal builds.

Checks: make check; make integration-test; go test ./... (legacy/go).

crates/latchd-core/src/audit.rs

@@ -1,12 +1,10 @@
-//! Redacted security audit events.
-//!
-//! Audit records exclude secrets, PAM messages, and command arguments.
+//! Logs audit events for login operations structurally, without including free-form messages from PAM modules that may contain sensitive information.
 
 use std::fmt;
 
 use crate::error::Error;
 
-/// The security operation that produced an audit event.
+/// Login operation that produced an audit event.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum AuditAction {
     Authentication,
@@ -24,7 +22,7 @@ impl fmt::Display for AuditAction {
     }
 }
 
-/// The outcome of a security operation.
+/// Result recorded for a login operation.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum AuditOutcome {
     Started,
@@ -44,7 +42,7 @@ impl fmt::Display for AuditOutcome {
     }
 }
 
-/// A safe category for a PAM failure, without exposing PAM's free-form text.
+/// Stable category for a PAM status without its free-form message.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum PamReason {
     AuthenticationRejected,
@@ -72,12 +70,12 @@ impl fmt::Display for PamReason {
     }
 }
 
-/// A structured event whose fields are safe to send to an audit logger.
+/// Event fields intended for the audit logger.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub struct AuditEvent<'a> {
     pub action: AuditAction,
     pub outcome: AuditOutcome,
-    /// Account name supplied by the user; never a password or token.
+    /// Account name supplied by the user, never a password or token.
     pub account: &'a str,
     pub pam_reason: Option<PamReason>,
 }
@@ -115,7 +113,7 @@ impl<'a> AuditEvent<'a> {
     }
 }
 
-/// Maps Linux-PAM status codes to stable, non-sensitive categories.
+/// Map Linux-PAM status codes to stable categories.
 pub const fn pam_reason(status: i32) -> PamReason {
     match status {
         6 | 7 => PamReason::AuthenticationRejected,