refactor: delete dead Go code (R1)

- internal/httpapi/stubs.go: delete — 5-line comment-only orphan file with
  no declarations; its own comment said the stubs live in phase3.go.
- internal/notifier/notifier.go: delete VerifyApprovalToken — zero call
  sites; phase3.go:DecideApproval reimplements the check inline (noted as
  dead in docs/mbse). hashToken stays (used by generateApprovalToken).
- internal/checkdefaults/defaults.go: unexport ResolveHost, ForEntityType,
  ShortSlug, DefaultInterval — only called within the package. Ensure stays
  exported (called by internal/db/seed.go).

go vet, go build, and affected tests pass.

internal/notifier/notifier.go

@@ -282,23 +282,6 @@ func generateApprovalToken(approvalID uuid.UUID, secret string) string {
 	return hex.EncodeToString(mac.Sum(nil))
 }
 
-// VerifyApprovalToken checks a token against the stored hash.
-func VerifyApprovalToken(ctx context.Context, pool *db.Pool, approvalID uuid.UUID, token string) bool {
-	var tokenHash *string
-	var status string
-	var expiresAt time.Time
-	err := pool.QueryRow(ctx,
-		"SELECT token_hash, status, expires_at FROM approvals WHERE entity_id = $1",
-		approvalID).Scan(&tokenHash, &status, &expiresAt)
-	if err != nil || tokenHash == nil {
-		return false
-	}
-	if status != "pending" || expiresAt.Before(time.Now()) {
-		return false
-	}
-	return *tokenHash == hashToken(token)
-}
-
 func hashToken(token string) string {
 	h := sha256.Sum256([]byte(token))
 	return hex.EncodeToString(h[:])