Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

src/CMakeLists.txt

@@ -36,6 +36,8 @@ idf_component_register(
         "web_server.c"
         "web_session_store.c"
         "web_auth_parse.c"
+        "web_httpd_adapter.c"
+        "web_cookie_auth.c"
         "web_login_ui.c"
         "web_console.c"
         "wifi_config.c"
@@ -70,6 +72,16 @@ idf_component_register(
         wolfssl__wolfssl
 )
 
+# Only web_httpd_adapter.c uses this private, version-checked boundary.
+target_include_directories(${COMPONENT_LIB} PRIVATE
+    "$ENV{IDF_PATH}/components/esp_http_server/src"
+    "$ENV{IDF_PATH}/components/esp_http_server/src/port/esp32")
+
+# HTTPD debug logs include header values; URI warnings include ticket queries.
+# Compile those out, independently of runtime log-level changes.
+idf_component_get_property(httpd_lib esp_http_server COMPONENT_LIB)
+target_compile_definitions(${httpd_lib} PRIVATE LOG_LOCAL_LEVEL=ESP_LOG_ERROR)
+
 # Public wolfSSH headers include wolfCrypt configuration from user_settings.h.
 target_compile_definitions(${COMPONENT_LIB} PRIVATE
     WOLFSSL_USER_SETTINGS