Complete Phase 12 dual-stack networking

Add IPv6-aware Wi-Fi state, HTTPS/SSH listeners, mDNS service
reconciliation, and browser Wi-Fi administration.

Include a guarded build-local fix for mDNS 1.12.0 membership handling,
focused regression suites, and Phase 12 acceptance documentation.

src/web_auth_parse.h

@@ -21,9 +21,11 @@ typedef struct {
 } web_auth_credentials_t;
 
 /* Exact byte spans, not necessarily NUL-terminated. Inputs and output must not
- * alias. Failures clear output. Host supports ASCII DNS/IPv4 authorities only;
- * IPv6 literals are deliberately rejected until the device supports that route.
- * Only optional :443 is accepted. Origin is mandatory and must match Host.
+ * alias. Failures clear output. Host supports ASCII DNS/IPv4 and bracketed IPv6.
+ * IPv6 uses lowercase hex, longest zero-run compression (first on ties), and
+ * hex tails even for mapped IPv4. No zones, DNS lookup or IPv4 equivalence.
+ * Only optional exact :443 is accepted. Origin is mandatory and must match
+ * canonical Host; accepting a literal does not establish network reachability.
  * HTTP callers must separately reject duplicate header lines, enforce methods,
  * body/content-type limits, Fetch Metadata and CSRF/session policy. */
 bool web_auth_parse_origin(const char *host, size_t host_length,