feat: add bounded admin WebSocket backend (Phase 8D.5)

- Require current admin cookie sessions, Origin checks and single-use
  tickets
- Reuse the shared console with session-aware authorization and slot
  allocation
- Add HTTPD-owned I/O, bounded buffering and revocation cleanup
- Prevent LRU eviction of serial clients and stale admin socket closure
- Reject unsupported web-shell mutations before side effects
- Add host regressions, a smoke client and resource accounting

Validated by user sign-off after a 15-minute full-client soak at 230400
baud, with a few broker drops under heavy output. Browser UI remains
for Phase 8D.6; numeric memory reserves remain open.

tests/web_admin_tickets/run.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+"""Compile production ticket C with deterministic boundary fakes; no firmware build."""
+import os
+import pathlib
+import runpy
+import subprocess
+import sys
+import tempfile
+
+sys.dont_write_bytecode = True
+os.environ["CCACHE_DISABLE"] = "1"
+HERE = pathlib.Path(__file__).resolve().parent
+ROOT = HERE.parents[1]
+HEADERS = runpy.run_path(str(HERE.parent / "web_session_store/run.py"))["HEADERS"]
+with tempfile.TemporaryDirectory(prefix="web-admin-tickets-") as directory:
+    tmp = pathlib.Path(directory)
+    for name, text in HEADERS.items():
+        path = tmp / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text)
+    sanitize = ["-fsanitize=address,undefined", "-fno-omit-frame-pointer"] if "--sanitize" in sys.argv else []
+    subprocess.run(["cc", "-std=c11", "-Wall", "-Wextra", "-Werror", "-g",
+                    *sanitize, "-I" + str(tmp), "-I" + str(ROOT / "src"),
+                    str(HERE / "test.c"), "-lcrypto", "-o", str(tmp / "test")],
+                   check=True, timeout=30)
+    subprocess.run([str(tmp / "test")], check=True, timeout=20)