refactor: split the TUI and refresh project docs

Move login state, authentication, discovery, input, rendering, and tests into focused TUI modules. Add detailed CLI error reports with recovery commands, align the build and host-check documentation, and keep the legacy Go tree outside normal builds.

Checks: make check; make integration-test; go test ./... (legacy/go).

scripts/test-system-e2e.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-# Report unavailable capabilities as SKIP. In strict mode, each SKIP is an error.
+# Report unavailable capabilities as SKIP; strict mode treats each skip as an error.
 set -u
 
 binary=${1:-}
@@ -43,7 +43,7 @@ else
     skip "latchd binary not supplied; capability-only probe"
 fi
 
-# This checks the PAM runtime only. Authentication requires a test account and policy.
+# Check the PAM runtime only; authentication still needs a test account and policy.
 if need_command ldconfig && ldconfig -p 2>/dev/null | grep -q 'libpam\.so'; then
     pass "PAM runtime library is available"
 else
@@ -65,14 +65,14 @@ else
     skip "faillock helper is unavailable"
 fi
 
-# A pseudo-terminal does not test VT allocation by the host or VM.
+# A pseudo-terminal cannot prove that the host can allocate a VT.
 if [ -c /dev/tty0 ] && [ -d /sys/class/tty/tty0 ]; then
     pass "Linux virtual terminal device is available"
 else
     skip "Linux virtual terminal is unavailable (container or non-console host)"
 fi
 
-# Xvfb tests X11 without access to the host display.
+# Xvfb checks X11 without using the host display.
 if need_command Xvfb; then
     display_number=$((100 + ($$ % 500)))
     display=":$display_number"
@@ -106,7 +106,7 @@ else
     skip "Xvfb is unavailable"
 fi
 
-# A compositor must own the Wayland socket. Installed client libraries are not sufficient.
+# A compositor must own the Wayland socket; installed client libraries are not enough.
 wayland_socket=
 if [ -n "${WAYLAND_DISPLAY:-}" ] && [ -n "${XDG_RUNTIME_DIR:-}" ]; then
     case "$WAYLAND_DISPLAY" in