refactor: split the TUI and refresh project docs

Move login state, authentication, discovery, input, rendering, and tests into focused TUI modules. Add detailed CLI error reports with recovery commands, align the build and host-check documentation, and keep the legacy Go tree outside normal builds.

Checks: make check; make integration-test; go test ./... (legacy/go).

legacy/go/auth/pam.go

@@ -1,4 +1,4 @@
-// Keep each PAM transaction on one OS thread. PAM modules can use thread-local state.
+// Keep each transaction on one OS thread because modules can use thread-local state.
 package auth
 
 /*
@@ -7,11 +7,11 @@ package auth
 #include <stdlib.h>
 #include <stdint.h>
 
-// Match the signature that cgo generates for //export.
+// Match the callback signature that cgo generates for //export.
 extern int latchd_pam_conv(int, struct pam_message **,
                             struct pam_response **, void *);
 
-// Store the numeric handle in C memory. Do not pass a Go pointer to PAM.
+// Store the numeric handle in C memory; never pass a Go pointer to the module.
 static void *storeHandle(uintptr_t h) {
 	uintptr_t *p = malloc(sizeof(uintptr_t));
 	if (p) *p = h;