Replace Web Basic Auth With Cookie Sessions

Add bounded login challenges, CSRF/origin enforcement, logout, and
session-bound WebSocket admission. Isolate private HTTPD access behind a
version-guarded adapter and add focused host coverage. Also let empty
admin
SSH input reach the normal console handler.

tests/web_ui_session/README.md

@@ -0,0 +1,52 @@
+# Existing serial app cookie-session cutover tests
+
+Run from the repository root:
+
+```sh
+python3 tests/web_ui_session/run.py
+```
+
+Requires a host C compiler, Python 3, and Node with Fetch/Response/ReadableStream
+support (Node 18+). All compiler outputs and rendered scripts are temporary; no
+firmware build, generated assets, or device writes are performed.
+
+The runner compiles production `src/web_ui.c` with HTTPD and vendored-asset data
+doubles. It reuses the HTTPD stub text from `tests/web_login_ui/run.py`, without
+importing/executing that runner. Node executes the actual C-rendered application
+and inline asset-failure script, not a separately maintained implementation.
+
+Coverage:
+
+- Resource selection, NULL/invalid input, setter/send failure propagation,
+  eight-header ceiling, no-store document/application, unchanged vendor caching,
+  nosniff/no-referrer/frame denial, exact inline-loader CSP hash and login fallback.
+- Session validation before initial/retried/restored connections; memory-only
+  CSRF header and empty ticket/logout bodies; safe-text username/absolute expiry.
+- 401 shutdown and navigation once; manual recovery on 403; bounded Retry-After
+  display/backoff for capacity; network errors never assert successful logout.
+- Confirmed 204 logout, lost response confirmed by session 401, uncertain logout,
+  cancellation, explicit recovery, and stale session/ticket/status/logout/WS work.
+- Pagehide/bfcache restoration, late response bodies, and superseded session checks.
+- Existing writer controls, 1,024-byte binary input chunks, raw binary output,
+  observer input gating, and explicit Disconnect pausing reconnect.
+- Authentication/ticket response cap 512 bytes, existing status cap 3,072 bytes,
+  15-second request deadline, single status request in flight, bounded retry delay,
+  and unchanged 5,000-line terminal scrollback.
+
+## Integration and known gaps
+
+This is only the existing application browser portion of Phase 8D.3. It requires
+the simultaneous server cookie/Origin/CSRF cutover for every route. The renderer
+still relies on its caller to authenticate resources; protected asset failures
+must be 401, never a redirect to HTML served as JavaScript. No Basic fallback is
+implemented here. No server, auth-store, transport, admin UI, or generated asset
+changes are included.
+
+These tests model DOM, timers, fetch cancellation and WebSocket events. They do
+not prove real-browser CSP enforcement, script-loading errors, TLS/HTTPD behavior,
+actual bfcache policy, cookie expiry, server revocation, or hardware serial byte
+integrity. Full firmware build and mandatory M1 browser/target checks remain the
+integrator's responsibility. The full build was deliberately not run in this
+restricted-write subtask. No target resource reserve is claimed. Browser secret
+references are dropped and never persisted/logged, but JavaScript cannot securely
+wipe engine-managed strings.