Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

src/web_httpd_adapter.h

@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#pragma once
+#include "esp_http_server.h"
+
+/* HTTPD-owner only, before body reads or any response. Reject duplicate lines,
+ * including Cookie, rather than trusting first-match public getters. */
+bool web_httpd_headers_valid(httpd_req_t *request);
+bool web_httpd_upgrade_requested(httpd_req_t *request);
+bool web_httpd_unread_body(httpd_req_t *request);
+/* After the final response/lookup: preserve only unread pipelined data on a
+ * keepalive connection. Closing requests may discard pending data entirely. */
+void web_httpd_wipe_request(httpd_req_t *request, bool closing);
+esp_err_t web_httpd_upgrade(httpd_req_t *request,
+                            esp_err_t (*handler)(httpd_req_t *));