Add admin serial settings view

tests/web_ui_session/README.md

@@ -44,11 +44,15 @@ Coverage:
   logout; same-session restore retains both scrollbacks behind validation gating.
 - Undefined initial dimensions recover at unchanged bounds; failed fits never
   populate the cache, readiness retries stop at three, and teardown fences stale
-  callbacks even after restore. Sixteen Node groups total.
+  callbacks even after restore.
+- Read-only admin Settings/Serial: 10 selection cycles preserve both sockets/IDs,
+  drain hidden output and block terminal input; exact eight-field/256-byte schema,
+  explicit refresh, error/timeout containment, late cancellation/restore/identity,
+  and concurrent serial reconnect without superseding admission. **21 Node groups total.**
 
 ## Integration and known gaps
 
-This covers the Phase 8D.3 browser session behavior and 8D.6 selector. The renderer
+This covers 8D.3 session behavior, the 8D.6 selector and 8D.8 Settings. The renderer
 still relies on its caller to authenticate resources; protected asset failures
 must be 401, never a redirect to HTML served as JavaScript. No Basic fallback is
 implemented here. Existing 8D.5 server authorization/protocols are unchanged.
@@ -57,7 +61,7 @@ These tests model DOM, timers, fetch cancellation and WebSocket events. They do
 not prove real-browser CSP enforcement, script-loading errors, TLS/HTTPD behavior,
 actual bfcache policy, cookie expiry, server revocation, or hardware serial byte
 integrity, actual xterm escape parsing, hidden prompts, or desktop/mobile layout.
-The 8D.6 firmware build and pending target checklist are recorded separately in
-`docs/phase8d6_implementation.md`. No target resource reserve is claimed. Browser secret
+Prior 8D.6 signoff stands; the new Settings build and pending target checklist are in
+`docs/phase8d8_implementation.md`. No target resource reserve is claimed. Browser secret
 references are dropped and never persisted/logged, but JavaScript cannot securely
 wipe engine-managed strings.