refactor: delete dead Go code (R1)

- internal/httpapi/stubs.go: delete — 5-line comment-only orphan file with
  no declarations; its own comment said the stubs live in phase3.go.
- internal/notifier/notifier.go: delete VerifyApprovalToken — zero call
  sites; phase3.go:DecideApproval reimplements the check inline (noted as
  dead in docs/mbse). hashToken stays (used by generateApprovalToken).
- internal/checkdefaults/defaults.go: unexport ResolveHost, ForEntityType,
  ShortSlug, DefaultInterval — only called within the package. Ensure stays
  exported (called by internal/db/seed.go).

go vet, go build, and affected tests pass.

internal/checkdefaults/defaults.go

@@ -19,7 +19,7 @@ type CheckDef struct {
 	Extra      map[string]any
 }
 
-func ResolveHost(attrs map[string]any) string {
+func resolveHost(attrs map[string]any) string {
 	if ip, ok := attrs["lan_ip"].(string); ok && ip != "" {
 		return ip
 	}
@@ -57,8 +57,8 @@ func resolveSSHPort(attrs map[string]any) int {
 	return 22
 }
 
-func ForEntityType(entityType string, attrs map[string]any) []CheckDef {
-	host := ResolveHost(attrs)
+func forEntityType(entityType string, attrs map[string]any) []CheckDef {
+	host := resolveHost(attrs)
 	user := resolveSSHUser(attrs)
 	port := resolveSSHPort(attrs)
 
@@ -122,7 +122,7 @@ func ForEntityType(entityType string, attrs map[string]any) []CheckDef {
 	return nil
 }
 
-func ShortSlug(slug string) string {
+func shortSlug(slug string) string {
 	const n = 8
 	if len(slug) > n {
 		return slug[len(slug)-n:]
@@ -130,7 +130,7 @@ func ShortSlug(slug string) string {
 	return slug
 }
 
-func DefaultInterval(kind string) int32 {
+func defaultInterval(kind string) int32 {
 	switch kind {
 	case "ping":
 		return 30
@@ -156,7 +156,7 @@ func Ensure(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, slug, entityType
 		attrs = map[string]any{}
 	}
 
-	defs := ForEntityType(entityType, attrs)
+	defs := forEntityType(entityType, attrs)
 	if len(defs) == 0 {
 		return
 	}
@@ -166,7 +166,7 @@ func Ensure(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, slug, entityType
 		if err != nil {
 			checkID = uuid.New()
 		}
-		checkSlug := fmt.Sprintf("check:%s:%s:%d", def.Kind, ShortSlug(slug), i)
+		checkSlug := fmt.Sprintf("check:%s:%s:%d", def.Kind, shortSlug(slug), i)
 
 		_, _ = tx.Exec(ctx,
 			`INSERT INTO entities (id, slug, type, name, state, attributes, version, created_at, updated_at)
@@ -199,6 +199,6 @@ func Ensure(ctx context.Context, tx pgx.Tx, entityID uuid.UUID, slug, entityType
 			`INSERT INTO check_defs (entity_id, target_id, kind, config, interval_s, timeout_s, enabled)
 			 VALUES ($1, $2, $3, $4, $5, 30, true)
 			 ON CONFLICT (entity_id) DO NOTHING`,
-			checkID, entityID, def.Kind, configJSON, DefaultInterval(def.Kind))
+			checkID, entityID, def.Kind, configJSON, defaultInterval(def.Kind))
 	}
 }

internal/httpapi/stubs.go

@@ -1,6 +0,0 @@
-package httpapi
-
-// Remaining stubs for endpoints that depend on tables not yet created
-// (knowledge_entities, agent_activity). These are kept here because the
-// phase3.go file already defines them; this file is deliberately empty.
-// The stubs live in phase3.go as simple errNotImplemented returns.

internal/notifier/notifier.go

@@ -282,23 +282,6 @@ func generateApprovalToken(approvalID uuid.UUID, secret string) string {
 	return hex.EncodeToString(mac.Sum(nil))
 }
 
-// VerifyApprovalToken checks a token against the stored hash.
-func VerifyApprovalToken(ctx context.Context, pool *db.Pool, approvalID uuid.UUID, token string) bool {
-	var tokenHash *string
-	var status string
-	var expiresAt time.Time
-	err := pool.QueryRow(ctx,
-		"SELECT token_hash, status, expires_at FROM approvals WHERE entity_id = $1",
-		approvalID).Scan(&tokenHash, &status, &expiresAt)
-	if err != nil || tokenHash == nil {
-		return false
-	}
-	if status != "pending" || expiresAt.Before(time.Now()) {
-		return false
-	}
-	return *tokenHash == hashToken(token)
-}
-
 func hashToken(token string) string {
 	h := sha256.Sum256([]byte(token))
 	return hex.EncodeToString(h[:])