Add typed account and password settings

- Add admin account list, create, role, delete, and password workflows
- Execute identity-checked mutations through the existing dispatcher
- Bound queued credential lifetime and wipe transient secrets
- Add explicit password generation with saved-value acknowledgement
- Handle self-revocation and uncertain outcomes without automatic
  retries
- Register optional account routes without disrupting terminal
  transports
- Expand host regressions and document contracts and pending target
  checks

Validated host suites and pio run; hardware validation remains pending.

tests/web_cookie_auth/run.py

@@ -45,6 +45,15 @@ esp_err_t httpd_ws_respond_server_handshake(httpd_req_t *, const char *);
 admin = "--admin" in sys.argv
 settings = "--settings" in sys.argv
 serial_settings = "--serial-settings" in sys.argv
+accounts = "--accounts" in sys.argv
+if accounts:
+    HEADERS["esp_timer.h"] += """
+#include <stdbool.h>
+typedef void *esp_timer_handle_t;
+typedef struct { void (*callback)(void *); const char *name; bool skip_unhandled_events; } esp_timer_create_args_t;
+int esp_timer_create(const esp_timer_create_args_t *, esp_timer_handle_t *);
+int esp_timer_start_periodic(esp_timer_handle_t, uint64_t);
+"""
 if admin:
     HEADERS["esp_system.h"] = "#pragma once\nvoid esp_restart(void);\n"
     HEADERS["esp_heap_caps.h"] = """#pragma once
@@ -132,6 +141,11 @@ with tempfile.TemporaryDirectory(prefix="web-cookie-auth-") as directory:
         settings_source += '    serial_service_counters_t serial_counters = {0};\n' + acquisition
         settings_source += '    return snprintf(response, capacity,\n' + serial_format + ',\n' + serial_arguments + ');\n}\n'
         (tmp / 'settings_production.h').write_text(settings_source)
+    if accounts:
+        db_source = (ROOT / 'src/user_database.c').read_text()
+        alphabet_start = db_source.index('static const uint8_t s_generated_alphabet')
+        alphabet = db_source[alphabet_start:db_source.index(';', alphabet_start) + 1]
+        (tmp / 'account_parse_production.h').write_text(alphabet + '\n' + '\n'.join(function(db_source, name) for name in ('user_database_username_valid', 'user_database_password_valid', 'user_role_parse', 'user_role_to_string', 'user_database_generate_password_value')))
     if serial_settings:
         config_source = (ROOT / 'src/serial_config.c').read_text()
         names = ['serial_config_defaults', 'serial_config_validate']
@@ -155,6 +169,7 @@ with tempfile.TemporaryDirectory(prefix="web-cookie-auth-") as directory:
                     *(["-DHOST_ADMIN"] if admin else []),
                     *(["-DHOST_SETTINGS"] if settings else []),
                     *(["-DHOST_SERIAL_SETTINGS"] if serial_settings else []),
+                    *(["-DHOST_ACCOUNTS"] if accounts else []),
                     "-I" + str(tmp), "-I" + str(ROOT / "src"), *map(str, sources), "-lcrypto",
                     "-o", str(tmp / "test")], check=True, timeout=30)
     subprocess.run([str(tmp / "test")], check=True, timeout=20)