Phase 8D.1 implemented and validated.

src/web_server.c

@@ -10,6 +10,7 @@
 
 #include "esp_http_server.h"
 #include "esp_https_server.h"
+#include "esp_log.h"
 #include "esp_netif_ip_addr.h"
 #include "esp_timer.h"
 #include "freertos/FreeRTOS.h"
@@ -24,6 +25,7 @@
 #include "user_database.h"
 #include "web_security.h"
 #include "web_serial_transport.h"
+#include "web_session_store.h"
 #include "web_ui.h"
 #include "wifi_manager.h"
 
@@ -652,6 +654,13 @@ esp_err_t web_server_start(void)
     serial_transport_ready = s_serial_transport_initialized;
     xSemaphoreGive(s_server_mutex);
 
+    /* Initialize only after admission: a rejected start must not undo stop.
+     * Dormant Phase 8D primitives do not gate the existing Basic-auth service. */
+    esp_err_t session_error = web_session_store_init();
+    if (session_error != ESP_OK) {
+        ESP_LOGW("web_server", "Session store unavailable: %s", esp_err_to_name(session_error));
+    }
+
     uint8_t certificate[WEB_SECURITY_CERTIFICATE_DER_CAPACITY] = {0};
     uint8_t private_key[WEB_SECURITY_PRIVATE_KEY_DER_CAPACITY] = {0};
     size_t certificate_length = 0U;
@@ -694,6 +703,9 @@ esp_err_t web_server_start(void)
         attach_error = web_serial_transport_attach_server(server);
         serial_transport_attached = attach_error == ESP_OK;
     }
+    if (error != ESP_OK) {
+        web_session_store_stop();
+    }
     if (error != ESP_OK && server != NULL) {
         esp_err_t cleanup_error = httpd_ssl_stop(server);
         if (cleanup_error == ESP_OK) {
@@ -738,6 +750,7 @@ esp_err_t web_server_stop(void)
     s_transitioning = true;
     xSemaphoreGive(s_server_mutex);
 
+    web_session_store_stop();
     if (serial_transport_attached) {
         esp_err_t detach_error = web_serial_transport_detach_server(server);
         if (detach_error != ESP_OK && detach_error != ESP_ERR_TIMEOUT) {