feat: add bounded admin WebSocket backend (Phase 8D.5)

- Require current admin cookie sessions, Origin checks and single-use
  tickets
- Reuse the shared console with session-aware authorization and slot
  allocation
- Add HTTPD-owned I/O, bounded buffering and revocation cleanup
- Prevent LRU eviction of serial clients and stale admin socket closure
- Reject unsupported web-shell mutations before side effects
- Add host regressions, a smoke client and resource accounting

Validated by user sign-off after a 15-minute full-client soak at 230400
baud, with a few broker drops under heavy output. Browser UI remains
for Phase 8D.6; numeric memory reserves remain open.

tests/web_cookie_auth/run.py

@@ -41,6 +41,24 @@ struct httpd_data { struct { unsigned max_resp_headers; } config; };
 esp_err_t httpd_ws_respond_server_handshake(httpd_req_t *, const char *);
 """
 
+admin = "--admin" in sys.argv
+if admin:
+    HEADERS["esp_heap_caps.h"] = """#pragma once
+#include <stddef.h>
+#define MALLOC_CAP_SPIRAM 1
+#define MALLOC_CAP_8BIT 2
+void *heap_caps_calloc(size_t, size_t, unsigned);
+void heap_caps_free(void *);
+"""
+    HEADERS["esp_timer.h"] += """
+#include <stdbool.h>
+typedef void *esp_timer_handle_t;
+typedef struct { void (*callback)(void *); const char *name; bool skip_unhandled_events; } esp_timer_create_args_t;
+int esp_timer_create(const esp_timer_create_args_t *, esp_timer_handle_t *);
+int esp_timer_start_periodic(esp_timer_handle_t, uint64_t);
+int esp_timer_delete(esp_timer_handle_t);
+"""
+
 def function(source, name):
     start = source.index(name + "(")
     start = source.rfind("\n", 0, start) + 1
@@ -79,7 +97,10 @@ with tempfile.TemporaryDirectory(prefix="web-cookie-auth-") as directory:
     (tmp / "installed_httpd.c").write_text(extracted)
     sources = [HERE / "test.c", tmp / "installed_httpd.c"]
     sources += [ROOT / "src" / name for name in ["web_session_store.c", "web_auth_parse.c", "web_cookie_auth.c", "web_httpd_adapter.c"]]
+    if admin:
+        sources += [ROOT / "src" / name for name in ["web_admin_tickets.c", "web_admin_transport.c"]]
     subprocess.run(["cc", "-std=c11", "-Wall", "-Wextra", "-Werror", "-g", "-DHOST_OPENSSL",
+                    *(["-DHOST_ADMIN"] if admin else []),
                     "-I" + str(tmp), "-I" + str(ROOT / "src"), *map(str, sources), "-lcrypto",
                     "-o", str(tmp / "test")], check=True, timeout=30)
     subprocess.run([str(tmp / "test")], check=True, timeout=20)