Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

src/admin_ssh_console.c

@@ -439,8 +439,9 @@ static bool remote_command_allowed(const admin_request_t *request)
     char *argv[ADMIN_SSH_CONSOLE_MAX_ARGUMENTS] = {0};
     /* Use exactly the same quote/escape parser as esp_console_run(). */
     size_t argc = esp_console_split_argv(copy, argv, ADMIN_SSH_CONSOLE_MAX_ARGUMENTS);
-    bool allowed = argc > 0U;
-    if (allowed && strcmp(argv[0], "user") == 0 && argc >= 2U &&
+    /* Empty input is handled quietly by esp_console_run(), not UART0 policy. */
+    bool allowed = true;
+    if (argc >= 2U && strcmp(argv[0], "user") == 0 &&
         (strcmp(argv[1], "bootstrap") == 0 || strcmp(argv[1], "recover") == 0)) {
         allowed = false;
     }