Add Phase 9C security hardening

Generate exact-hash SDK source overrides without modifying dependencies.
Harden
SSH allocation and algorithm policy, tighten web authentication cleanup,
and add
focused host contract tests and documentation.

src/ssh_memory.h

@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#pragma once
+
+#include <stddef.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Install these hooks before wolfSSH/wolfSSL allocations begin. No module state,
+ * locks or allocation headers. Free/realloc accept only live allocation BASE
+ * pointers from this allocator (or NULL), never interior pointers.
+ *
+ * PSRAM is preferred, with internal 8-bit heap fallback. malloc(0) follows the
+ * SDK allocator. free wipes the full owned usable extent. realloc(NULL, size)
+ * delegates to malloc; realloc(non-NULL, 0) securely frees and returns NULL.
+ *
+ * Realloc within the usable extent retains the pointer AND capacity: it wipes
+ * [size, capacity), but does not reclaim memory. Growth copies the entire old
+ * usable extent, not merely the original requested size. Both allocations are
+ * live until copying finishes; failure leaves the old allocation unchanged.
+ * This is heap-retirement cleanup, not a guarantee about live library buffers
+ * or stack secrets. Only the guarded, audited unpoisoned IDF build is supported.
+ */
+void *ssh_memory_malloc(size_t size);
+void ssh_memory_free(void *pointer);
+void *ssh_memory_realloc(void *pointer, size_t size);
+
+#ifdef __cplusplus
+}
+#endif