feat: add bounded admin WebSocket backend (Phase 8D.5)

- Require current admin cookie sessions, Origin checks and single-use
  tickets
- Reuse the shared console with session-aware authorization and slot
  allocation
- Add HTTPD-owned I/O, bounded buffering and revocation cleanup
- Prevent LRU eviction of serial clients and stale admin socket closure
- Reject unsupported web-shell mutations before side effects
- Add host regressions, a smoke client and resource accounting

Validated by user sign-off after a 15-minute full-client soak at 230400
baud, with a few broker drops under heavy output. Browser UI remains
for Phase 8D.6; numeric memory reserves remain open.

src/web_serial_transport.c

@@ -16,6 +16,7 @@
 #include "serial_service.h"
 #include "web_auth_parse.h"
 #include "web_httpd_adapter.h"
+#include "web_admin_transport.h"
 
 #if !defined(CONFIG_HTTPD_WS_SUPPORT) || !CONFIG_HTTPD_WS_SUPPORT
 #error "web_serial_transport requires CONFIG_HTTPD_WS_SUPPORT"
@@ -1843,6 +1844,7 @@ esp_err_t web_serial_transport_revoke_user(const uint8_t *username,
     }
 
     web_session_store_invalidate_username(username, username_length);
+    web_admin_transport_revoke(0, username, username_length);
     bool notify = false;
     taskENTER_CRITICAL(&s_lock);
     if (s_ticket_epoch != UINT64_MAX) {
@@ -1879,6 +1881,7 @@ esp_err_t web_serial_transport_revoke_user(const uint8_t *username,
 esp_err_t web_serial_transport_revoke_sessions(void)
 {
     web_session_store_invalidate_username(NULL, 0U);
+    web_admin_transport_revoke(0, NULL, 0);
     taskENTER_CRITICAL(&s_lock);
     if (s_ticket_epoch != UINT64_MAX) {
         ++s_ticket_epoch;
@@ -1907,6 +1910,7 @@ esp_err_t web_serial_transport_revoke_web_session(web_session_id_t id)
         return ESP_ERR_INVALID_ARG;
     }
     web_session_store_invalidate(id);
+    web_admin_transport_revoke(id, NULL, 0);
     taskENTER_CRITICAL(&s_lock);
     if (s_ticket_epoch != UINT64_MAX) {
         ++s_ticket_epoch;