Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

src/web_login_ui.c

@@ -110,7 +110,8 @@ static const char s_login_html[] =
     "    const abort = new AbortController(); controller = abort;\n"
     "    const timeout = setTimeout(() => abort.abort(), 15000);\n"
     "    let csrf = '';\n"
-    "    const options = {credentials:'same-origin', mode:'same-origin', cache:'no-store', redirect:'error', signal:abort.signal};\n"
+    /* CORS mode preserves Origin under no-referrer; CSP still limits connections to self. */
+    "    const options = {credentials:'same-origin', mode:'cors', cache:'no-store', redirect:'error', signal:abort.signal};\n"
     "    try {\n"
     "      const challenge = await fetch('/api/login-challenge', {...options, headers:{'X-Login-Bootstrap':'1'}});\n"
     "      if (current !== generation) return;\n"
@@ -152,7 +153,7 @@ esp_err_t web_login_ui_send_response(httpd_req_t *request)
     if (error == ESP_OK) error = httpd_resp_set_hdr(request, "Referrer-Policy", "no-referrer");
     if (error == ESP_OK) error = httpd_resp_set_hdr(request, "X-Frame-Options", "DENY");
     if (error == ESP_OK) error = httpd_resp_set_hdr(request, "Content-Security-Policy",
-        "default-src 'none'; script-src 'sha256-x70ID2kbifGBVYfh/pePTt5v/AVHkT7JVAV0LjT1wCo='; "
+        "default-src 'none'; script-src 'sha256-eZO4pMDQx6SIaa5AFlMnuf0CD5JdGSWyi8lNVmCNPBQ='; "
         "style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; "
         "form-action 'none'; frame-ancestors 'none'");
     if (error == ESP_OK) error = httpd_resp_send(request, s_login_html, sizeof(s_login_html) - 1U);