refactor(gateway)!: remove legacy v1 device-auth handshake

docs/concepts/architecture.md

@@ -97,8 +97,8 @@ sequenceDiagram
   for subsequent connects.
 - **Local** connects (loopback or the gateway host’s own tailnet address) can be
   auto‑approved to keep same‑host UX smooth.
-- **Non‑local** connects must sign the `connect.challenge` nonce and require
-  explicit approval.
+- All connects must sign the `connect.challenge` nonce.
+- **Non‑local** connects still require explicit approval.
 - Gateway auth (`gateway.auth.*`) still applies to **all** connections, local or
   remote.
 

docs/gateway/protocol.md

@@ -206,7 +206,7 @@ The Gateway treats these as **claims** and enforces server-side allowlists.
 - All WS clients must include `device` identity during `connect` (operator + node).
   Control UI can omit it **only** when `gateway.controlUi.dangerouslyDisableDeviceAuth`
   is enabled for break-glass use.
-- Non-local connections must sign the server-provided `connect.challenge` nonce.
+- All connections must sign the server-provided `connect.challenge` nonce.
 
 ## TLS + pinning