feat!: remove the v1 line-based socket protocol (#75)

v2 JSON-RPC is now the only socket protocol. All consumers were migrated
first (CLI in #74, shell integration in #72, tests in #71/#73; the remote
daemon was already v2-only), so this deletes the v1 line dispatch itself
and everything that only existed to serve it.

- TerminalController.processCommand now dispatches JSON unconditionally;
  a non-JSON line gets a terse v1_removed error instead of being routed
  to the old space-delimited command switch.
- Deletes the v1 switch (~90 cases) and every handler function that
  becomes unreferenced, plus their v1-only parsing helpers
  (parseOptions/parseOptionsNoStop, resolveTabForReport,
  withReportTargetSurface, upsertSidebarMetadata/clearSidebarMetadata/
  listSidebarMetadata, schedulePanelMetadataMutation,
  parseReadScreenArgs). Debug handlers that v2's debug.* methods reuse
  as their implementation core (setShortcut, simulateShortcut,
  activateApp, isTerminalFocused, readTerminalText, renderStats,
  layoutDebug, bonsplit/empty-panel/flash counters,
  focusFromNotification, panelSnapshot(Reset), captureScreenshot) are
  kept, since they're still live v2 entry points, not v1 relics.
  Self.socketFastPathState and tailTerminalLines/
  readTerminalTextBase64(terminalPanel:) stay too - v2 surface-telemetry
  and screen-read methods depend on them directly.
- auth was already a connection-level preamble (authResponseIfNeeded,
  handled before any protocol dispatch) supporting both a raw
  auth-plus-password line and v2 auth.login; only the CLI's raw-line
  call needed migrating, which this does (auth.login now).
- Removes the now-unreachable isV2:false focus-intent allowlist
  (focusIntentV1Commands) and updates the one unit test that exercised
  it directly to cover the v2 equivalent instead.
- Docs: v2-api-migration.md collapses to a short removal note plus the
  v1->v2 name mapping (kept for reference); socket-focus-steal-audit.todo.md
  and agent-browser-port-spec.md get historical annotations; CLAUDE.md's
  socket-threading-policy examples are reworded to v2 method names.

TerminalController.swift: 12834 -> 9615 lines (-3219). Net repo diff:
+156/-3410 across 7 files.

Breaking change: any external script or tool that still speaks the old
space-delimited socket protocol directly (rather than through the CLI)
will now get a v1_removed JSON error instead of a response. Use the CLI
or the v2 JSON-RPC protocol described in docs/v2-api-migration.md.

Author: arzafran

CLAUDE.md

@@ -173,7 +173,7 @@ The app has a **Debug** menu in the macOS menu bar (only in DEBUG builds). Use i
 
 ## Socket command threading policy
 
-- Do not use `DispatchQueue.main.sync` for high-frequency socket telemetry commands (`report_*`, `ports_kick`, status/progress/log metadata updates).
+- Do not use `DispatchQueue.main.sync` for high-frequency socket telemetry commands (`surface.report_*`, `surface.ports_kick`, status/progress/log metadata updates).
 - For telemetry hot paths:
   - Parse and validate arguments off-main.
   - Dedupe/coalesce off-main first.
@@ -184,7 +184,7 @@ The app has a **Debug** menu in the macOS menu bar (only in DEBUG builds). Use i
 ## Socket focus policy
 
 - Socket/CLI commands must not steal macOS app focus (no app activation/window raising side effects).
-- Only explicit focus-intent commands may mutate in-app focus/selection (`window.focus`, `workspace.select/next/previous/last`, `surface.focus`, `pane.focus/last`, browser focus commands, and v1 focus equivalents).
+- Only explicit focus-intent commands may mutate in-app focus/selection (`window.focus`, `workspace.select/next/previous/last`, `surface.focus`, `pane.focus/last`, browser focus commands).
 - All non-focus commands should preserve current user focus context while still applying data/model changes.
 
 ## Testing policy

CLI/programa.swift

@@ -2835,11 +2835,12 @@ struct CMUXCLI {
             explicit: explicitPassword,
             socketPath: socketPath
         ) {
-            let authResponse = try client.send(command: "auth \(socketPassword)")
-            if authResponse.hasPrefix("ERROR:"),
-               !authResponse.contains("Unknown command 'auth'") {
-                throw CLIError(message: authResponse)
-            }
+            // v2 JSON-RPC auth.login. The server treats this the same whether or not
+            // password auth is actually required: when required, the pre-protocol auth
+            // gate verifies the password before any command is processed; when not
+            // required, the server's own auth.login handler answers with
+            // authenticated: true, required: false rather than an error.
+            _ = try client.sendV2(method: "auth.login", params: ["password": socketPassword])
         }
     }