Add typed account and password settings

- Add admin account list, create, role, delete, and password workflows
- Execute identity-checked mutations through the existing dispatcher
- Bound queued credential lifetime and wipe transient secrets
- Add explicit password generation with saved-value acknowledgement
- Handle self-revocation and uncertain outcomes without automatic
  retries
- Register optional account routes without disrupting terminal
  transports
- Expand host regressions and document contracts and pending target
  checks

Validated host suites and pio run; hardware validation remains pending.

src/web_auth_parse.h

@@ -40,6 +40,11 @@ bool web_auth_parse_cookie(const char *header, size_t length, const char *name,
  * lets HTTP policy distinguish absence from malformed/ambiguous cookies. */
 bool web_auth_parse_optional_cookie(const char *header, size_t length, const char *name,
                                     char token[WEB_AUTH_TOKEN_LENGTH + 1U], bool *present);
+/* Decode one string at *position (including optional JSON whitespace). Capacity
+ * includes the terminator. Failure wipes output and leaves position unchanged.
+ * Success output is sensitive; caller must wipe it. Same strict decoder as login. */
+bool web_auth_parse_json_string(const char *body, size_t length, size_t *position,
+                                 uint8_t *output, size_t capacity, size_t *decoded_length);
 /* Exactly username/password string fields, either order. JSON escapes and valid
  * UTF-8 accepted; unknown/duplicate fields, NUL and malformed Unicode rejected.
  * Database credential policy remains authoritative. Caller must wipe BOTH the