Add typed account and password settings

- Add admin account list, create, role, delete, and password workflows
- Execute identity-checked mutations through the existing dispatcher
- Bound queued credential lifetime and wipe transient secrets
- Add explicit password generation with saved-value acknowledgement
- Handle self-revocation and uncertain outcomes without automatic
  retries
- Register optional account routes without disrupting terminal
  transports
- Expand host regressions and document contracts and pending target
  checks

Validated host suites and pio run; hardware validation remains pending.

tests/admin_console_boundary/fakes.h

@@ -31,7 +31,8 @@ typedef int *SemaphoreHandle_t;
 #define pdMS_TO_TICKS(x) (x)
 #define CONSOLE_COMPLETION_OUTPUT_CAPACITY 1024U
 static unsigned lock_depth, ticks, runs, actions;
-static uint32_t serial_settings_executed;
+static uint32_t serial_settings_executed, account_settings_executed;
+static void web_account_settings_execute(uint32_t id) { assert(!lock_depth); account_settings_executed = id; }
 static unsigned serial_settings_preceding_runs, queue_send_wait;
 static void web_serial_settings_execute(uint32_t id) {
     assert(!lock_depth);