feat: add bounded admin WebSocket backend (Phase 8D.5)

- Require current admin cookie sessions, Origin checks and single-use
  tickets
- Reuse the shared console with session-aware authorization and slot
  allocation
- Add HTTPD-owned I/O, bounded buffering and revocation cleanup
- Prevent LRU eviction of serial clients and stale admin socket closure
- Reject unsupported web-shell mutations before side effects
- Add host regressions, a smoke client and resource accounting

Validated by user sign-off after a 15-minute full-client soak at 230400
baud, with a few broker drops under heavy output. Browser UI remains
for Phase 8D.6; numeric memory reserves remain open.

src/web_admin_transport.h

@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#pragma once
+
+#include "esp_http_server.h"
+#include "web_session_store.h"
+
+#define WEB_ADMIN_TICKET_URI "/api/admin/ws-ticket"
+#define WEB_ADMIN_WS_URI "/ws/admin"
+#define WEB_ADMIN_MAX_SESSIONS 1U
+#define WEB_ADMIN_RX_CAPACITY 512U
+#define WEB_ADMIN_TX_CAPACITY 1024U
+
+typedef struct {
+    bool initialized, attached, active, closing;
+    uint32_t connections, disconnections, capacity_rejections, authorization_rejections;
+    uint32_t protocol_errors, input_backpressure, send_failures, queue_failures;
+    uint32_t rx_bytes, tx_bytes;
+    size_t static_bytes, payload_bytes;
+    esp_err_t last_error;
+} web_admin_transport_snapshot_t;
+
+/* Lifecycle caller serializes init/attach/detach/stopped. Optional PSRAM-only
+ * payload allocation; no internal fallback, new task, broker client or dispatcher.
+ * Timer only queues at most one poll; HTTPD owns all payload/IO/session cleanup. */
+esp_err_t web_admin_transport_init(void);
+esp_err_t web_admin_transport_attach(httpd_handle_t server);
+/* Disable admission and console access, then wait a bounded time for timer
+ * submissions to finish. On timeout do NOT stop/free HTTPD; retry detach first. */
+esp_err_t web_admin_transport_detach(httpd_handle_t server);
+/* Call ONLY after successful httpd_ssl_stop, including partial startup cleanup.
+ * Retires any unexecuted queued poll before allowing reuse of its static storage. */
+void web_admin_transport_stopped(httpd_handle_t server);
+
+/* Ordinary HTTP routes, never register is_websocket=true: admission before 101.
+ * These handlers enforce cookie/Origin/CSRF/role themselves. Binary frames carry
+ * console bytes, final/unfragmented, at most RX_CAPACITY; no serial controls. */
+esp_err_t web_admin_transport_ticket_handler(httpd_req_t *request);
+esp_err_t web_admin_transport_upgrade_handler(httpd_req_t *request);
+/* Notification after authoritative store invalidation. id wins; else exact
+ * username; else all. Safe before init. No socket calls from notifier context. */
+void web_admin_transport_revoke(web_session_id_t id, const uint8_t *username, size_t length);
+void web_admin_transport_get_snapshot(web_admin_transport_snapshot_t *snapshot);