Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

src/web_auth_parse.h

@@ -36,6 +36,10 @@ bool web_auth_parse_origin(const char *host, size_t host_length,
  * name is a trusted, nonempty C string. Output is sensitive: wipe after use. */
 bool web_auth_parse_cookie(const char *header, size_t length, const char *name,
                            char token[WEB_AUTH_TOKEN_LENGTH + 1U]);
+/* As above, but a missing selected cookie is valid with present=false. This
+ * lets HTTP policy distinguish absence from malformed/ambiguous cookies. */
+bool web_auth_parse_optional_cookie(const char *header, size_t length, const char *name,
+                                    char token[WEB_AUTH_TOKEN_LENGTH + 1U], bool *present);
 /* Exactly username/password string fields, either order. JSON escapes and valid
  * UTF-8 accepted; unknown/duplicate fields, NUL and malformed Unicode rejected.
  * Database credential policy remains authoritative. Caller must wipe BOTH the