Add allocation-free web auth parsers

Implement strict origin, cookie, and login JSON parsing with
fail-closed validation and output wiping. Add focused host contract
tests
and document the preparatory 8D.3 parser split.

tests/web_auth_parse/README.md

@@ -0,0 +1,42 @@
+# Web authentication parser host tests
+
+Run from the repository root:
+
+```sh
+python3 tests/web_auth_parse/run.py
+```
+
+Requires Python 3 (standard library only) and a host `cc` supporting shared
+libraries. The runner compiles the actual `src/web_auth_parse.c` with
+`-std=c11 -Wall -Wextra -Werror -shared -fPIC` into a temporary directory, loads
+it with `ctypes`, and removes build artifacts on exit. No firmware dependencies,
+parser substitutes, network access, or persistent build artifacts are used.
+Compilation errors and test failures produce nonzero exit status.
+
+Tables cover DNS/IPv4 origin canonicalization, case folding and optional `:443`,
+malformed authorities/origins and unsupported IPv6; selected cookie presence,
+uniqueness, exact lowercase 64-digit hex and surrounding cookie syntax; strict
+login JSON, both field orders, escapes, Unicode/surrogate pairs, invalid UTF-8,
+NUL, duplicate/unknown fields, truncation and byte limits (512-byte body,
+16-byte username, 64-byte password). Boundary cases include canonical origin
+capacity and the 1024-byte Cookie header limit.
+
+Inputs use exact byte spans without implicit terminators and never alias
+outputs. Each output is first filled with `0xA5`; every failed call must clear
+**all** output bytes, including credential structure padding and unused array
+bytes. Successful results check canonical/decoded bytes and termination.
+
+## Limitations
+
+- This is a focused parser contract suite, not HTTP integration, authorization,
+  CSRF/session, duplicate HTTP header-line, TLS, credential-policy, or hardware
+  testing. Empty credentials are syntactically valid; database policy is separate.
+- IPv6 is intentionally rejected, not normalized or supported.
+- Python mirrors the public C struct and capacities; interface changes must
+  update these tests. Shared-library loading assumes a Unix-like host/compiler.
+- Tables are not exhaustive fuzzing, memory-safety instrumentation, or proof of
+  constant-time behavior. Output wiping is observed after return; this does not
+  establish erasure of internal temporaries or successful credentials. Test
+  credentials/tokens are synthetic, not secrets.
+- NULL output pointers and overlapping buffers are not exercised: valid,
+  disjoint output storage is provided for every call.