Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

src/web_serial_transport.h

@@ -100,7 +100,7 @@ esp_err_t web_serial_transport_detach_server(httpd_handle_t server);
 
 /*
  * Mint a one-time bearer ticket bound to a current authenticated principal and
- * originating web-session ID (zero only for the shipped Basic path). The
+ * nonzero originating web-session ID. The
  * principal is copied; the output is exactly 32 Base64URL characters plus a
  * terminator and expires after 30 monotonic seconds. Never log or persist it.
  */
@@ -111,7 +111,7 @@ esp_err_t web_serial_transport_mint_ticket(const user_principal_t *principal,
 /*
  * Convenience POST response helper for /api/ws-ticket. Authentication is
  * intentionally outside this module: pass the principal returned by successful
- * authentication, and its session ID (zero for Basic). Cookie callers must also
+ * authentication, and its session ID. Callers must also
  * enforce CSRF/Origin policy. Register as HTTP_POST, not as a public handler.
  */
 esp_err_t web_serial_transport_handle_authenticated_ticket_request(
@@ -119,13 +119,13 @@ esp_err_t web_serial_transport_handle_authenticated_ticket_request(
     web_session_id_t web_session_id);
 
 /*
- * Handler for /ws/serial. Register as HTTP_GET with is_websocket=true and
- * handle_ws_control_frames=false. The initial upgraded GET authenticates the
- * ticket; later invocations process one complete data frame.
+ * Frame callback installed by the HTTPD adapter after authorized admission.
+ * Do not register directly: the initial HTTP GET must pass cookie/Origin policy
+ * and call the session handler below before any 101 response.
  */
 esp_err_t web_serial_transport_ws_handler(httpd_req_t *request);
-/* Trusted future cookie-authorized upgrade caller; must validate cookie/Origin
- * first. Zero identifies only the shipped Basic path, never a cookie fallback. */
+/* Trusted cookie-authorized upgrade caller; validate cookie/Origin first.
+ * Zero is invalid for initial admission; no Basic fallback exists. */
 esp_err_t web_serial_transport_session_ws_handler(httpd_req_t *request,
                                                  web_session_id_t web_session_id);
 /* Invalidates the store first, then marks only matching tickets/slots for owner
@@ -140,7 +140,7 @@ esp_err_t web_serial_transport_clear_counters(void);
 
 /* Invalidate cookie records and tickets/sockets for one username (also after
  * deletion), or all accounts. Store invalidation occurs even if serial init
- * failed; these do not touch the HTTPD-owned Basic cache, which rechecks DB. */
+ * failed. Authoritative store/principal checks supplement notifications. */
 esp_err_t web_serial_transport_revoke_user(const uint8_t *username,
                                            size_t username_length);
 esp_err_t web_serial_transport_revoke_sessions(void);