fix(hubclient): remove dead GetWSTicket client code

[ptone]

Summary

• Removes the latent GetWSTicket() method from the AuthService interface and its implementation in pkg/hubclient/auth.go
• Removes the WSTicketResponse type
• Removes mock stubs from pkg/hub/auth/device_flow_test.go and cmd/hub_auth_test.go

Decision Rationale

Decision: Remove the dead code (rather than implement the missing server route).

Investigation findings:

1. No production callers — GetWSTicket() is only referenced in its own definition (interface + implementation) and two mock stubs in test files. No production code invokes it.
2. WebSocket auth works without ws-ticket — The web UI's terminal component (web/src/components/pages/terminal.ts) connects via new WebSocket(url) using same-origin session cookies. No ticket-based auth exchange is needed.
3. No server route exists — POST /api/v1/auth/ws-ticket is not registered on the hub server, so the client method would always fail if called.

Keeping a client method that posts to a non-existent endpoint is misleading and adds unnecessary surface area to the AuthService interface.

Test plan

• go build ./... passes
• go vet ./... passes
• go test ./pkg/hubclient/... ./pkg/hub/auth/... ./cmd/... — all pass

[ptone]

Code Review: APPROVE ✅

Risk: LOW — Pure dead-code removal (0 additions, 24 deletions).

(Posted as comment because the token cannot self-approve.)

Verified

• GetWSTicket() method removed from AuthService interface and implementation
• WSTicketResponse type removed
• Two mock stubs removed from test files
• Grep confirms zero orphaned references to GetWSTicket or WSTicketResponse in the tree
• go build and go vet pass on affected packages
• No unrelated changes

Notes

• Correct decision to delete rather than implement a server route with no callers
• PR body documents the reasoning well (no callers, WS auth via session cookies, no server route)

Clean change. No findings.