Add typed account and password settings

- Add admin account list, create, role, delete, and password workflows
- Execute identity-checked mutations through the existing dispatcher
- Bound queued credential lifetime and wipe transient secrets
- Add explicit password generation with saved-value acknowledgement
- Handle self-revocation and uncertain outcomes without automatic
  retries
- Register optional account routes without disrupting terminal
  transports
- Expand host regressions and document contracts and pending target
  checks

Validated host suites and pio run; hardware validation remains pending.

src/web_server.c

@@ -24,6 +24,7 @@
 #include "web_security.h"
 #include "web_serial_transport.h"
 #include "web_serial_settings.h"
+#include "web_account_settings.h"
 #include "web_admin_transport.h"
 #include "web_session_store.h"
 #include "web_cookie_auth.h"
@@ -388,6 +389,20 @@ static const httpd_uri_t s_serial_operation_post_uri = {
     .handler = web_serial_settings_handler,
 };
 
+static const httpd_uri_t s_accounts_uri = {
+    .uri = "/api/settings/accounts", .method = HTTP_GET, .handler = web_account_settings_handler,
+};
+static const httpd_uri_t s_account_operation_get_uri = {
+    .uri = "/api/settings/account-operation", .method = HTTP_GET, .handler = web_account_settings_handler,
+};
+static const httpd_uri_t s_account_operation_post_uri = {
+    .uri = "/api/settings/account-operation", .method = HTTP_POST, .handler = web_account_settings_handler,
+};
+static const httpd_uri_t s_account_generate_password_uri = {
+    .uri = "/api/settings/accounts/generate-password", .method = HTTP_POST,
+    .handler = web_account_generate_password_handler,
+};
+
 static const httpd_uri_t s_root_uri = {
     .uri = "/",
     .method = HTTP_GET,
@@ -576,7 +591,7 @@ esp_err_t web_server_start(void)
         config.httpd.max_open_sockets = 6;
         config.httpd.max_uri_handlers =
             sizeof(s_uri_handlers) / sizeof(s_uri_handlers[0]) +
-            sizeof(s_auth_uris) / sizeof(s_auth_uris[0]) + 5U;
+            sizeof(s_auth_uris) / sizeof(s_auth_uris[0]) + 9U;
         /* Exhaustion rejects new sockets, never evicts an existing serial writer. */
         config.httpd.lru_purge_enable = false;
         config.httpd.recv_wait_timeout = 1;
@@ -627,6 +642,11 @@ esp_err_t web_server_start(void)
         if (web_httpd_register_optional(server, &s_serial_operation_get_uri) == ESP_OK &&
             web_httpd_register_optional(server, &s_serial_operation_post_uri) != ESP_OK)
             (void)httpd_unregister_uri_handler(server, s_serial_operation_get_uri.uri, HTTP_GET);
+        if (web_httpd_register_optional_get(server, &s_accounts_uri) == ESP_OK &&
+            web_httpd_register_optional_get(server, &s_account_operation_get_uri) == ESP_OK &&
+            web_httpd_register_optional(server, &s_account_operation_post_uri) != ESP_OK)
+            (void)httpd_unregister_uri_handler(server, s_account_operation_get_uri.uri, HTTP_GET);
+        (void)web_httpd_register_optional(server, &s_account_generate_password_uri);
     }
     if (error != ESP_OK) {
         web_cookie_auth_stop();