Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

src/web_cookie_auth.h

@@ -0,0 +1,19 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#pragma once
+#include "esp_http_server.h"
+#include "web_session_store.h"
+
+esp_err_t web_cookie_auth_start(void);
+void web_cookie_auth_stop(void);
+typedef struct {
+    uint32_t login_attempts, login_failures, throttled, capacity_rejections;
+    uint32_t security_rejections, logouts, active_challenges;
+    bool ready;
+} web_cookie_auth_snapshot_t;
+void web_cookie_auth_get_snapshot(web_cookie_auth_snapshot_t *snapshot);
+void web_cookie_auth_clear_counters(void);
+/* Sends an error on denial, with allowed=false. View is caller-wiped. */
+esp_err_t web_cookie_auth_require(httpd_req_t *request, bool mutation,
+                                  bool upgrade, web_session_view_t *view,
+                                  bool *allowed);
+esp_err_t web_cookie_auth_handler(httpd_req_t *request);