remove experimental web UI

The web UI shipped as "experimental" and was never finished — no nav
off the dashboard, no live updates, no settled design, never a
supported surface. It was opt-in by default already; leaving the code
in the tree for v0.1.0 only invited "does this work?" questions and
kept HostSummary/BangerSummary/SudoStatus types on the public RPC
surface that nothing else uses.

Removed:

  internal/webui/                         (all Go + templates + assets)
  internal/daemon/web.go                  (server start / Layout / Config / ListVMs / ListImages)
  internal/daemon/dashboard.go            (DashboardSummary aggregator)

Simplified:

  internal/api/types.go                   drop WebURL on PingResult, drop
                                          HostSummary / SudoStatus / BangerSummary /
                                          DashboardSummary / DashboardSummaryResult
  internal/model/types.go                 drop DaemonConfig.WebListenAddr
  internal/config/config.go               drop web_listen_addr from fileConfig + Load
  internal/daemon/daemon.go               drop webListener / webServer / webURL fields +
                                          startWebServer() call + ping WebURL population
  internal/cli/banger.go                  `daemon status` output no longer branches on web
  internal/daemon/{doc.go,ARCHITECTURE.md} drop web UI sections
  README.md                               drop web_listen_addr config bullet + security paragraph

Tests updated to reflect the new shape. Coverage 57.3 -> 58.9% (the
webui package was largely untested; its removal lifts the ratio
without moving the numerator). `banger daemon status` output and
--help are web-free. Lint + full suite green.

internal/daemon/ARCHITECTURE.md

@@ -34,7 +34,7 @@ owning types:
 - `tapPool tapPool` — TAP interface pool; owns its own lock.
 - `sessions sessionRegistry` — active guest session controllers; owns
   its own lock.
-- `listener`, `webListener`, `webServer`, `webURL`, `vmDNS` — networking.
+- `listener`, `vmDNS` — networking.
 - `vmCaps` — registered VM capability hooks.
 - `pullAndFlatten`, `finalizePulledRootfs`, `bundleFetch`,
   `requestHandler`, `guestWaitForSSH`, `guestDial`,
@@ -98,9 +98,3 @@ Only `internal/cli` imports this package. The surface is:
 
 All other `*Daemon` methods are reached only through the RPC `dispatch`
 switch in `daemon.go` and are free to move/rename during refactoring.
-
-## Web UI
-
-The optional web UI served at `web_listen_addr` is experimental. It is
-enabled by default for local observability but is not considered a stable
-or supported interface. Set `web_listen_addr = ""` in config to disable.