Add typed account and password settings

- Add admin account list, create, role, delete, and password workflows
- Execute identity-checked mutations through the existing dispatcher
- Bound queued credential lifetime and wipe transient secrets
- Add explicit password generation with saved-value acknowledgement
- Handle self-revocation and uncertain outcomes without automatic
  retries
- Register optional account routes without disrupting terminal
  transports
- Expand host regressions and document contracts and pending target
  checks

Validated host suites and pio run; hardware validation remains pending.

src/web_auth_parse.c

@@ -208,6 +208,23 @@ static bool string(json_cursor_t *c, uint8_t *out, size_t capacity, size_t *leng
     return true;
 }
 
+bool web_auth_parse_json_string(const char *body, size_t length, size_t *position,
+                                 uint8_t *output, size_t capacity, size_t *decoded_length)
+{
+    if (output && capacity) wipe(output, capacity);
+    if (decoded_length) *decoded_length = 0;
+    if (!body || !position || *position > length || !output || !capacity || !decoded_length)
+        return false;
+    json_cursor_t c = { (const uint8_t *)body, length, *position };
+    if (!string(&c, output, capacity - 1U, decoded_length)) {
+        wipe(output, capacity);
+        *decoded_length = 0;
+        return false;
+    }
+    *position = c.pos;
+    return true;
+}
+
 bool web_auth_parse_login(const char *body, size_t length,
                           web_auth_credentials_t *credentials)
 {