Extend browser admin lifecycle actions

Support browser reboot and HTTPS stop through deferred control, plus
exact
`web certificate rotate --force` handoff to the dispatcher. Add typed
request
validation and focused boundary and lifecycle coverage.

src/admin_ssh_console.h

@@ -35,6 +35,8 @@ typedef enum {
     ADMIN_SSH_DEFER_HOST_KEY_ROTATE,
     ADMIN_SSH_DEFER_HOST_KEY_RESET,
     ADMIN_CONSOLE_DEFER_SELF_CLOSE,
+    ADMIN_CONSOLE_DEFER_WEB_STOP,
+    ADMIN_CONSOLE_DEFER_WEB_CERTIFICATE_ROTATE,
 } admin_ssh_deferred_action_type_t;
 
 /* Small owner boundary; module/API names are retained for existing SSH callers.
@@ -44,7 +46,10 @@ typedef enum {
  * An occupied or still-executing slot cannot be replaced by open_owned().
  *
  * The immutable adapter lives for firmware lifetime. Callbacks run on the
- * control task OUTSIDE console locks for drained/perform. Required is_current
+ * control task OUTSIDE console locks for drained/perform, except perform actions
+ * selected by dispatcher_actions run serialized on the existing 12KiB dispatcher
+ * after drain/delay and queued identity/principal revalidation (no command replay).
+ * Zero dispatcher_actions preserves legacy control-task execution. Required is_current
  * runs on the dispatcher outside console locks; it must be bounded and validate
  * full transport identity, originating-session liveness and principal binding,
  * without calling socket libraries or handlers. Core separately checks accounts.
@@ -53,7 +58,9 @@ typedef enum {
  * its owner, never call socket libraries here. Neither callback may call console
  * handlers. supported_actions is a bitmask (1U << action); reject unsupported
  * actions before side effects. Legacy STOP/DISCONNECT/key actions mean SSH;
- * SELF_CLOSE means this frontend, with argument ignored.
+ * SELF_CLOSE means this frontend; WEB_STOP means HTTPS, not SSH.
+ * WEB_CERTIFICATE_ROTATE replaces the HTTPS identity and restarts HTTPS.
+ * These WEB actions and SELF_CLOSE ignore argument.
  *
  * One owner serializes feed calls per session; different owners may feed in
  * parallel. Shared completion scratch is nonblocking/serialized by the core.
@@ -66,10 +73,13 @@ typedef enum {
  * Close wakes prompts; executing state is retained until the handler returns.
  * Output remains bounded (5s write backpressure); deferred work waits at most
  * 10s for application drain plus 200ms, NOT peer-delivery confirmation.
+ * Dispatcher actions then wait behind queued commands/prompts, with input gated
+ * until completion or cancellation; the drain bound is not an execution deadline.
  * No new tasks, queues, slots, or browser endpoint are provided by this API.
  */
 typedef struct {
     uint32_t supported_actions;
+    uint32_t dispatcher_actions; /* Subset of supported_actions; immutable. */
     bool (*is_current)(const admin_ssh_console_token_t *token,
                        const user_principal_t *principal);
     bool (*drained)(const admin_ssh_console_token_t *token);
@@ -95,6 +105,7 @@ typedef struct {
     bool command_pending;
     bool input_pending;
     bool output_pending;
+    bool deferred_action_pending;
     size_t input_length;
     size_t output_length;
 } admin_ssh_console_session_snapshot_t;
@@ -108,6 +119,7 @@ esp_err_t admin_ssh_console_start_uart_frontend(void);
 
 /* Valid only while a registered command callback runs on the dispatcher task. */
 bool admin_ssh_console_dispatch_is_remote(void);
+bool admin_ssh_console_dispatch_is_web(void);
 const user_principal_t *admin_ssh_console_dispatch_principal(void);
 esp_err_t admin_ssh_console_dispatch_read_input(
     const char *prompt, uint8_t *output, size_t capacity,