Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

src/web_login_ui.h

@@ -4,7 +4,6 @@
 #include "esp_err.h"
 #include "esp_http_server.h"
 
-/* Standalone public login document for the future atomic 8D.3 cutover.
- * Rendering only: no authentication, URI registration, or session allocation.
- * Do not expose this page until its protected API and application routes exist. */
+/* Standalone public login document. Rendering only: authentication, route
+ * registration and bounded challenge allocation belong to web_cookie_auth. */
 esp_err_t web_login_ui_send_response(httpd_req_t *request);