Add allocation-free web auth parsers

Implement strict origin, cookie, and login JSON parsing with
fail-closed validation and output wiping. Add focused host contract
tests
and document the preparatory 8D.3 parser split.

src/web_auth_parse.h

@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+/* Private, allocation-free parsing only: these helpers do not authorize requests. */
+#pragma once
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define WEB_AUTH_ORIGIN_CAPACITY 129U
+#define WEB_AUTH_COOKIE_HEADER_MAX 1024U
+#define WEB_AUTH_TOKEN_LENGTH 64U
+#define WEB_AUTH_LOGIN_BODY_MAX 512U
+#define WEB_AUTH_USERNAME_MAX 16U
+#define WEB_AUTH_PASSWORD_MAX 64U
+
+typedef struct {
+    size_t username_length;
+    size_t password_length;
+    uint8_t username[WEB_AUTH_USERNAME_MAX + 1U];
+    uint8_t password[WEB_AUTH_PASSWORD_MAX + 1U];
+} web_auth_credentials_t;
+
+/* Exact byte spans, not necessarily NUL-terminated. Inputs and output must not
+ * alias. Failures clear output. Host supports ASCII DNS/IPv4 authorities only;
+ * IPv6 literals are deliberately rejected until the device supports that route.
+ * Only optional :443 is accepted. Origin is mandatory and must match Host.
+ * HTTP callers must separately reject duplicate header lines, enforce methods,
+ * body/content-type limits, Fetch Metadata and CSRF/session policy. */
+bool web_auth_parse_origin(const char *host, size_t host_length,
+                           const char *origin, size_t origin_length,
+                           char canonical[WEB_AUTH_ORIGIN_CAPACITY]);
+/* Extract exactly one named lowercase-hex token; malformed/duplicate or missing
+ * selected cookie fails. Other cookies are syntax-checked but not retained.
+ * This deliberately accepts only unquoted cookie values, including unrelated
+ * cookies; quoted values fail closed. No whitespace inside a cookie pair.
+ * name is a trusted, nonempty C string. Output is sensitive: wipe after use. */
+bool web_auth_parse_cookie(const char *header, size_t length, const char *name,
+                           char token[WEB_AUTH_TOKEN_LENGTH + 1U]);
+/* Exactly username/password string fields, either order. JSON escapes and valid
+ * UTF-8 accepted; unknown/duplicate fields, NUL and malformed Unicode rejected.
+ * Database credential policy remains authoritative. Caller must wipe BOTH the
+ * original request body and successful credentials using secure_wipe(). */
+bool web_auth_parse_login(const char *body, size_t length,
+                          web_auth_credentials_t *credentials);