feat: add bounded admin WebSocket backend (Phase 8D.5)

- Require current admin cookie sessions, Origin checks and single-use
  tickets
- Reuse the shared console with session-aware authorization and slot
  allocation
- Add HTTPD-owned I/O, bounded buffering and revocation cleanup
- Prevent LRU eviction of serial clients and stale admin socket closure
- Reject unsupported web-shell mutations before side effects
- Add host regressions, a smoke client and resource accounting

Validated by user sign-off after a 15-minute full-client soak at 230400
baud, with a few broker drops under heavy output. Browser UI remains
for Phase 8D.6; numeric memory reserves remain open.

src/CMakeLists.txt

@@ -31,6 +31,8 @@ idf_component_register(
         "user_console.c"
         "web_security.c"
         "web_serial_transport.c"
+        "web_admin_tickets.c"
+        "web_admin_transport.c"
         "web_assets_data.c"
         "web_ui.c"
         "web_server.c"