Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

src/web_auth_parse.c

@@ -61,9 +61,11 @@ static bool cookie_name_char(unsigned char c)
     return alnum_ascii(c) || (c && strchr("!#$%&'*+-.^_`|~", c));
 }
 
-bool web_auth_parse_cookie(const char *header, size_t length, const char *name,
-                           char token[WEB_AUTH_TOKEN_LENGTH + 1U])
+bool web_auth_parse_optional_cookie(const char *header, size_t length, const char *name,
+                                    char token[WEB_AUTH_TOKEN_LENGTH + 1U], bool *present)
 {
+    if (!present) return false;
+    *present = false;
     if (!token) return false;
     memset(token, 0, WEB_AUTH_TOKEN_LENGTH + 1U);
     if (!header || !name || !*name || !length || length > WEB_AUTH_COOKIE_HEADER_MAX)
@@ -92,7 +94,15 @@ bool web_auth_parse_cookie(const char *header, size_t length, const char *name,
         if (pos < length && ++pos == length) return false;
     }
     if (found) memcpy(token, header + selected, WEB_AUTH_TOKEN_LENGTH);
-    return found;
+    *present = found;
+    return true;
+}
+
+bool web_auth_parse_cookie(const char *header, size_t length, const char *name,
+                           char token[WEB_AUTH_TOKEN_LENGTH + 1U])
+{
+    bool present = false;
+    return web_auth_parse_optional_cookie(header, length, name, token, &present) && present;
 }
 
 typedef struct { const uint8_t *data; size_t length; size_t pos; } json_cursor_t;