Add admin serial settings view

tests/web_cookie_auth/README.md

@@ -15,3 +15,24 @@ Coverage includes challenge reuse/consumption/expiry, capacities without evictio
 This is **not** the full IDF parser/dispatcher, real handshake/TLS/socket, browser, multicore task or hardware test. The private struct doubles do not prove binary layout; firmware compilation uses the actual pinned headers, and the version guard requires a new audit on SDK changes. Handshake sending and transport revocation are doubled. Actual on-wire pre-101 rejection, frame routing, pipelining/early bytes, cookie/CSP/browser recovery and loaded expiry latency remain M1 target gates. No sanitizer or runtime memory-reserve result is implied.
 
 See `docs/phase8d3_implementation.md` for source verification, other suite commands, build accounting and the target checklist.
+
+## Read-only Serial Settings
+
+```sh
+python3 tests/web_cookie_auth/run.py --settings
+```
+
+Runs the existing auth/store suite plus five 8D.8 groups. Compiles exact extracted
+production server handler/helpers, serial snapshot getter and enum formatters,
+with the real cookie/store/parser/private adapter. Serial locking/state and HTTP
+IO are doubled; authorization is not. Exercises normal-role/stale/expired/revoked
+denial, DB failure, body/query/method/header/framing/Origin rejection before any
+serial read, working values, zero-wait busy/uninitialized failure, no-store and
+header/send errors. Adapter-only allocator substitution injects both staged
+registration failures; the installed IDF unregister function frees successful
+registration. No SDK files are modified. Lifecycle registration/optional failure
+orchestration is separately tested by `tests/web_admin_transport/server_lifecycle.py`.
+
+This does not run the full serial task/UART driver, TLS/network dispatcher or a real
+browser. Target comparison with UART0 and runtime memory/stack validation remain
+pending in `docs/phase8d8_implementation.md`; prior M2 signoff remains accepted.