Add fleet registry removal with confirm modal and agent_removed WS.

Operators can remove machines from Crucible and dashboard rosters with honest messaging that deletion is registry-only; bulk select, oath ledger entries, and Go/Vitest coverage included.

server/internal/api/websocket.go

@@ -2043,7 +2043,7 @@ func (h *WSHub) SendToAgent(agentID string, msg Message) error {
 }
 
 // RemoveAgent forcibly disconnects an agent and removes it from the live map.
-// It then broadcasts agent_deleted to all dashboard clients so the UI removes
+// It then broadcasts agent_removed to all dashboard clients so the UI removes
 // the agent immediately without waiting for the disconnect goroutine to fire.
 func (h *WSHub) RemoveAgent(agentID string) {
 	h.mu.Lock()
@@ -2062,9 +2062,9 @@ func (h *WSHub) RemoveAgent(agentID string) {
 		ac.Conn.Close()
 	}
 	h.mu.Unlock()
-	// Broadcast deletion so every connected dashboard removes the agent immediately.
+	// Broadcast removal so every connected dashboard drops the agent immediately.
 	h.broadcastDashboard(Message{
-		Type:    "agent_deleted",
+		Type:    "agent_removed",
 		Payload: mustMarshal(map[string]string{"agent_id": agentID}),
 	})
 }