Implement SSH authorized key management

src/web_account_settings.h

@@ -7,6 +7,21 @@
  * results are replaceable, not durable history or an idempotent retry API. */
 esp_err_t web_account_settings_handler(httpd_req_t *request);
 void web_account_settings_execute(uint32_t id);
+/* POST /api/settings/accounts/keys: admin cookie + Origin/CSRF, JSON exactly
+ * {username,user_id,auth_generation}. Read-only zero-wait snapshot, 512-byte
+ * response bound: {username,user_id,auth_generation,keys:[{index,type,fingerprint}]}.
+ * Fingerprints are OpenSSH SHA256: base64 without padding, never key blobs.
+ * Stale/absent target: 409 {error:"stale"}; busy DB: 503 accounts_unavailable.
+ * Register independently as an optional POST route.
+ *
+ * Existing account-operation POST adds key-add (+public_key, OpenSSH text <=384
+ * decoded bytes), key-delete (+key_index integer 0..2), key-clear. All require
+ * username/user_id/auth_generation. Exact schemas, <=768 body bytes/4 receives.
+ * Text/base64 errors: 400; canonical SSH blob/curve validation runs on dispatcher
+ * (failed result). Duplicate/full/stale use existing named result states.
+ * Success target-revokes immediately, including self; lost response/401 remains
+ * uncertain, never proof of cancellation. No automatic mutation retries. */
+esp_err_t web_account_keys_handler(httpd_req_t *request);
 /* POST /api/settings/accounts/generate-password; bodyless admin cookie +
  * Origin/CSRF. RNG only, no queued/account/persistent state or retrieval. */
 esp_err_t web_account_generate_password_handler(httpd_req_t *request);