chore(v1.100.1b.B): GOTH PR-D4 stage 2 — delete cmd/nftban-ui + cmd/nftban-ui-auth + internal/ui source trees (#500)

* chore(goth): delete cmd/nftban-ui/ source tree

Per 1.100.1b.B narrow boundary (locked 2026-04-26 after read-only
breakage-map scoping pass): zero non-self Go consumers, zero compile-
survival edits required.

Files removed:
  cmd/nftban-ui/main.go              (474 LOC)
  cmd/nftban-ui/handlers/goth.go     (3,408 LOC)
  cmd/nftban-ui/handlers/metrics_handlers.go    (1,284 LOC)
  cmd/nftban-ui/handlers/settings_handlers.go     (671 LOC)
  cmd/nftban-ui/handlers/settings_handlers_test.go (396 LOC)
  cmd/nftban-ui/handlers/sse_handlers.go           (359 LOC)
  cmd/nftban-ui/handlers/chart_handlers.go         (187 LOC)
  cmd/nftban-ui/disable-dev-mode.sh                (script)
  cmd/nftban-ui/enable-dev-mode.sh                 (script)

Total: 9 files, ~6,779 LOC + 2 dev-mode shell scripts.

The packages internal/api, internal/middleware, internal/auth,
internal/session, internal/authproto become orphaned-but-still-
compiling; their deletion is deferred to 1.100.1b.C.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(goth): delete cmd/nftban-ui-auth/ source tree

Per 1.100.1b.B narrow boundary: zero non-self Go consumers,
zero compile-survival edits required.

Files removed:
  cmd/nftban-ui-auth/main.go  (249 LOC)

cmd/nftban-ui-auth was the PAM-backed authentication daemon that
served the Web GUI. Its imports of internal/auth + internal/authproto
leave with this delete; the packages themselves become orphaned-but-
still-compiling (they have other internal callers via internal/api +
internal/middleware) and are deferred to 1.100.1b.C.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(goth): delete internal/ui/ package

Per 1.100.1b.B narrow boundary: only cmd/nftban-ui imported this
package; that consumer was deleted in the prior commit on this branch.
Now zero callers, zero compile-survival edits required.

Files removed:
  internal/ui/types.go              (1,185 LOC)
  internal/ui/layout.templ + _templ (~1,000 LOC compiled)
  internal/ui/pages/ (7 pages: health, metrics, modules, network,
                      system, whitelist, settings — both .templ and
                      generated _templ.go pairs)
  internal/ui/components/           (templ component subtree)
  internal/ui/ui-registry.json      (UI route registry)

Total: 34 files, ~23,894 LOC.

This is the largest single deletion of v1.100.1b.B by LOC count.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(changelog): v1.100.1b.B — GOTH PR-D4 stage 2 (source-tree delete)

Document the 3-directory narrow source delete: cmd/nftban-ui (~6,947
LOC), cmd/nftban-ui-auth (249 LOC), internal/ui (~23,894 LOC). Total
~31,090 LOC removed across 44 files.

Note that orphaned-but-still-compiling packages (internal/api,
internal/middleware, internal/auth, internal/session, internal/authproto)
remain for 1.100.1b.C, and lifecycle completion (PR-25-30) remains
explicitly open.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(deps): go mod tidy after 1.100.1b.B source delete

Removed dependencies that were only used by the deleted GOTH UI surface:
  - github.com/a-h/templ           (templ rendering — used by internal/ui)
  - github.com/msteinert/pam/v2    (PAM bindings — used by cmd/nftban-ui-auth)

Plus go.sum lines for transitively-removed deps (76 → 70 lines).

Mechanical fallout from the source-tree delete in this same PR. No new
dependencies added; no version bumps. Verified via `go mod tidy` on
lab2 (Go 1.25.0).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(docker): prune Dockerfile UI/auth references after 1.100.1b.B

Mechanical fallout of cmd/nftban-ui + cmd/nftban-ui-auth + internal/ui
deletion. Removes the build-graph references that no longer exist:

- linux-pam-dev (build) — only required by nftban-ui-auth
- go install templ + templ generate — only generated internal/ui/*.templ
- go build ./cmd/nftban-ui — directory deleted
- linux-pam (runtime) — only required by nftban-ui-auth
- COPY /out/nftban-ui — binary no longer built

No general Docker refactor; no image slimming beyond stale-line removal;
no behavior change for nftban-core or nftband.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: itcmsgr

CHANGELOG.md

@@ -11,6 +11,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [Unreleased] - v1.100.1b.B GOTH PR-D4 stage 2 (source-tree delete)
+
+### Removed
+
+- **`cmd/nftban-ui/`** (entire directory): the GOTH-stack web server source tree. 9 files, ~6,947 LOC. Includes `main.go`, the 5 handler files, and the dev-mode shell scripts.
+- **`cmd/nftban-ui-auth/`** (entire directory): the PAM-backed authentication daemon source tree. 1 file, 249 LOC.
+- **`internal/ui/`** (entire package): the templ-rendered UI surface — layout, types, ui-registry.json, plus the `pages/` and `components/` subtrees. 34 files, ~23,894 LOC.
+
+### Notes
+
+This is a **narrow source delete** (3 directories with zero non-self Go consumers). The orphaned-but-still-compiling packages — `internal/api`, `internal/middleware`, `internal/auth`, `internal/session`, `internal/authproto` — are intentionally **not** removed in this release. They will be deleted in v1.100.1b.C alongside the cross-cutting reference cleanup in `cli/lib/`, `internal/installer/`, and `internal/nftbanconf/`.
+
+Build still passes (`go build ./...`) after this delete because the orphaned packages still compile internally; the static dependency graph between them is intact even though they have zero callers.
+
+Lifecycle completion work (PR-25 restore execution, PR-26 verification gate, PR-27-30 maintenance) remains explicitly **open** and is not affected by this release.
+
+---
+
 ## [Unreleased] - v1.100.1b.A GOTH PR-D4 stage 1 (stop shipping nftban-ui + nftban-ui-auth)
 
 ### Changed (operator-impacting)

Dockerfile

@@ -18,21 +18,18 @@
 FROM golang:1.25-alpine AS builder
 
 # hadolint ignore=DL3018
-RUN apk add --no-cache git make bash linux-pam-dev gcc musl-dev
+RUN apk add --no-cache git make bash gcc musl-dev
 
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
 
-# Install templ and generate files, then build all binaries
-RUN go install github.com/a-h/templ/cmd/templ@v0.3.977 && \
-    templ generate && \
-    mkdir -p /out && \
+# Build all binaries
+RUN mkdir -p /out && \
     CGO_ENABLED=1 GOOS=linux go build -o /out/nftban-core ./cmd/nftban-core && \
-    CGO_ENABLED=1 GOOS=linux go build -o /out/nftband ./cmd/nftband && \
-    CGO_ENABLED=0 GOOS=linux go build -o /out/nftban-ui ./cmd/nftban-ui
+    CGO_ENABLED=1 GOOS=linux go build -o /out/nftband ./cmd/nftband
 
 # Stage 2: Minimal runtime image
 # Pinned to SHA for OpenSSF Scorecard compliance
@@ -44,8 +41,7 @@ RUN apk add --no-cache \
     nftables \
     jq \
     curl \
-    ca-certificates \
-    linux-pam && \
+    ca-certificates && \
     addgroup -S nftban && \
     adduser -S -G nftban nftban && \
     mkdir -p /etc/nftban /var/lib/nftban /var/log/nftban /run/nftban && \
@@ -54,7 +50,6 @@ RUN apk add --no-cache \
 # Copy binaries from builder
 COPY --from=builder /out/nftban-core /usr/bin/
 COPY --from=builder /out/nftband /usr/bin/
-COPY --from=builder /out/nftban-ui /usr/bin/
 
 # Copy CLI scripts
 COPY cli/sbin/nftban /usr/sbin/nftban