chore(v1.100.1b.C1): delete GOTH orphan Go packages (#501)

* chore(v1.100.1b.C1): delete GOTH orphan Go packages

Removes the 5 packages that became orphaned-but-still-compiling after
1.100.1b.B deleted cmd/nftban-ui, cmd/nftban-ui-auth, internal/ui:

- internal/api/         (35 files, ~9.4k LOC)
- internal/middleware/  (3 files, ~932 LOC)
- internal/auth/        (2 files, ~457 LOC)
- internal/session/     (1 file, ~219 LOC)
- internal/authproto/   (1 file, ~53 LOC)

These 5 packages form a closed dependency subgraph: every cross-edge is
internal to the set, and zero non-self packages import any of them. The
single outside reference (cmd/nftband/daemon_http.go:82) is a TODO
comment, not an import.

Verified: `go build ./...` is expected to remain clean — no other
binary (nftban-core, nftband, nftban-installer, nftban-validate)
imports these packages.

Tests removed with their packages:
- internal/api/handlers_logs_test.go
- internal/api/helpers_test.go
- internal/middleware/rate_limiter_test.go

Out of scope for C1 (deferred to C2):
- internal/nftbanconf/ UIService field removals
- cli/lib/cmd_*.sh nftban-ui carveouts + cli/cmd_ui.sh dead-file delete
- internal/installer/ UI socket/payload/path carveouts
- packaging/ (rpm spec, deb rules, build_nftban.sh) carveouts

Lifecycle completion lane (PR-25..PR-30) remains explicitly OPEN.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs(v1.100.1b.C1): CHANGELOG entry for orphan-package delete

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(deps): go mod tidy after 1.100.1b.C1 orphan-package delete

Mechanical fallout: removes the 2 GOTH dependencies that were only
imported by the deleted orphan packages.

- github.com/golang-jwt/jwt/v5 v5.3.1 (was used by internal/auth)
- github.com/gorilla/mux v1.8.1 (was used by internal/api)

go.mod: -2 lines | go.sum: -4 lines | no behavior change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: itcmsgr

CHANGELOG.md

@@ -11,6 +11,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [Unreleased] - v1.100.1b.C1 GOTH orphan-package delete
+
+### Removed
+
+- **`internal/api/`** (35 files, ~9,435 LOC): GOTH HTTP handlers — orphaned after 1.100.1b.B deleted `cmd/nftban-ui` (the only consumer of these handlers).
+- **`internal/middleware/`** (3 files, ~932 LOC): GOTH HTTP middleware (auth, rate limiter) — orphaned after `internal/api` lost its consumer.
+- **`internal/auth/`** (2 files, ~457 LOC): PAM authentication wrapper — orphaned after `internal/api` and `internal/middleware` lost their consumers.
+- **`internal/session/`** (1 file, ~219 LOC): in-memory session store — orphaned after the same cascade.
+- **`internal/authproto/`** (1 file, ~53 LOC): PAM protocol types — orphaned after `internal/auth` lost its consumer.
+
+### Notes
+
+These 5 packages formed a closed dependency subgraph after 1.100.1b.B: every cross-edge was internal to the set, and zero non-self packages imported any of them. The single outside reference in `cmd/nftband/daemon_http.go:82` was a TODO comment, not an import.
+
+Out of scope for C1 (deferred to **C2**):
+- `internal/nftbanconf/` UIService/UIAuthService field removals
+- `cli/lib/cmd_*.sh` nftban-ui carveouts + dead `cli/cmd_ui.sh` delete
+- `internal/installer/` UI socket-enable + payload + paths carveouts
+- `packaging/` (`rpm/nftban-ui.spec`, `deb/rules`, `build_nftban.sh`) carveouts
+
+Workflow comment cleanup, doc cleanup, and changelog narrative cleanup remain deferred to **1.100.1b.D**.
+
+Lifecycle completion lane (PR-25 restore execution, PR-26 verification gate, PR-27-30 maintenance) remains explicitly **OPEN** and is not affected by this release.
+
+---
+
 ## [Unreleased] - v1.100.1b.B GOTH PR-D4 stage 2 (source-tree delete)
 
 ### Removed

go.mod

@@ -5,9 +5,7 @@ go 1.25.0
 require (
 	github.com/coreos/go-systemd/v22 v22.7.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/nftables v0.3.0
-	github.com/gorilla/mux v1.8.1
 	github.com/oschwald/geoip2-golang v1.13.0
 	github.com/oschwald/maxminddb-golang v1.13.1
 	github.com/prometheus/client_golang v1.23.2

go.sum

@@ -9,14 +9,10 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
-github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/nftables v0.3.0 h1:bkyZ0cbpVeMHXOrtlFc8ISmfVqq5gPJukoYieyVmITg=
 github.com/google/nftables v0.3.0/go.mod h1:BCp9FsrbF1Fn/Yu6CLUc9GGZFw/+hsxfluNXXmxBfRM=
-github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
-github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=