Add typed account and password settings

- Add admin account list, create, role, delete, and password workflows
- Execute identity-checked mutations through the existing dispatcher
- Bound queued credential lifetime and wipe transient secrets
- Add explicit password generation with saved-value acknowledgement
- Handle self-revocation and uncertain outcomes without automatic
  retries
- Register optional account routes without disrupting terminal
  transports
- Expand host regressions and document contracts and pending target
  checks

Validated host suites and pio run; hardware validation remains pending.

tests/web_ui_session/README.md

@@ -65,7 +65,24 @@ Coverage:
 - Repeated current Settings selection is a no-op during submission, between and
   during result checks, and during completion refresh: requests, timers, visible
   values/control state, final outcome and socket/writer identity remain intact.
-  **35 Node groups total.**
+- Accounts: admin-only strict eight-user/1,024-byte list, no secret/key fields,
+  confirmed identity-bound role/delete, automatic completion/list refresh,
+  ten-check limit/manual recovery, stale/protected/failure and lost-acknowledgement
+  handling, cancellation, and 401/identity isolation. The original 41 groups remain;
+  the former self-denial assertion now checks enabled self actions and confirmation cancellation.
+- Second slice: exact create/password JSON and CSRF, 768-byte request ceiling,
+  untrimmed 12–64 printable ASCII passwords including spaces/quotes/backslashes,
+  confirmation and username validation, separate bodyless generation without
+  mutation/list changes, strict 24-character base64url/96-byte generation response.
+- Generated acknowledgement binds value and operation/target identity; edits,
+  regeneration, target/purpose changes reset it. 60-second lifetime, including
+  delayed timer admission checks; submission/cancel/failure and all lifecycle wipes.
+  Late headers/streamed bodies, concurrent reconnect and newer snapshots are fenced.
+- Self password/role/delete warnings and POST/poll 401 close both routes without
+  success claims or proactive logout. Safe duplicate/full messages and no routine
+  secret outputs, storage, clipboard writes or history APIs.
+  **57 Node groups total**, plus renderer/HTML/CSP checks, reported PASS by the UI
+  continuation agent (four added beyond its earlier 53-group slice 2 run).
 
 ## Automatic result-check budget
 
@@ -91,7 +108,8 @@ existing 15-second per-request bound (session validation and snapshot GET are
 separate requests). Settings remain visible but conflicting controls are disabled
 during work; old snapshots are explicitly stale during pending/uncertain work or
 a failed refresh. A successful refresh replaces the browser draft. Only Reset
-asks for confirmation, specifically because it overwrites saved configuration.
+asks for confirmation among Serial actions, specifically because it overwrites saved
+configuration. Every Accounts mutation retains an explicit confirmation.
 
 Tests use a deterministic clock and individually fired timer callbacks, including
 callbacks invoked after cancellation and fetch/body doubles that ignore abort.
@@ -100,8 +118,10 @@ These deliberately exercise fences beyond normal browser cancellation behavior.
 ## Integration and known gaps
 
 This covers 8D.3 session behavior, the 8D.6 selector, 8D.8 Settings and the 8D.9
-Serial UI. Operation responses are fetch doubles, not end-to-end execution of
-`web_serial_settings.c`, dispatcher work, serial reconfiguration or NVS persistence. The renderer
+Serial UI and both 8D.10 Accounts slices. Operation/generation responses are fetch
+doubles, not end-to-end execution of `web_serial_settings.c`,
+`web_account_settings.c`, dispatcher work, credential generation/derivation,
+serial reconfiguration or NVS persistence. The renderer
 still relies on its caller to authenticate resources; protected asset failures
 must be 401, never a redirect to HTML served as JavaScript. No Basic fallback is
 implemented here. Existing 8D.5 server authorization/protocols are unchanged.
@@ -110,7 +130,13 @@ These tests model DOM, timers, fetch cancellation and WebSocket events. They do
 not prove real-browser CSP enforcement, script-loading errors, TLS/HTTPD behavior,
 actual bfcache policy, cookie expiry, server revocation, or hardware serial byte
 integrity, actual xterm escape parsing, hidden prompts, or desktop/mobile layout.
-Prior 8D.6 signoff stands; the new Settings build and pending target checklist are in
-`docs/phase8d8_implementation.md`. No target resource reserve is claimed. Browser secret
+Prior 8D.6 signoff stands; current slice 2 contracts and pending target checklist are in
+`docs/phase8d10_implementation.md`. Implementation is complete, host-tested/build-verified,
+not target accepted: parent build PASS 25.61 s, 95,908 B RAM / 1,694,237 B flash.
+The generated endpoint is independently optionally registered (23 handlers), with
+route-agent lifecycle 15 PASS for failure isolation/restart. UI 57/CSP and lifecycle
+15 results are agent-attributed, not claims of the parent's additional reruns.
+Target/signoff and new timer runtime measurements remain open; no sanitizer,
+device/assets/commit/8D.11 action or target resource reserve is claimed. Browser secret
 references are dropped and never persisted/logged, but JavaScript cannot securely
 wipe engine-managed strings.