Add Phase 9C security hardening

Generate exact-hash SDK source overrides without modifying dependencies.
Harden
SSH allocation and algorithm policy, tighten web authentication cleanup,
and add
focused host contract tests and documentation.

tests/wolfssh_auth_contract/README.md

@@ -14,8 +14,9 @@ preprocess and execution subprocesses have 30/30/10-second limits.
 
 The runner prefers the sole `.pio/build/*/compile_commands.json`, otherwise the
 root database. Select another existing database with `--compile-commands PATH`.
-It preprocesses the actual wolfSSH `internal.c` compile command (`-E -dM`) and
-checks this reviewed profile:
+It requires the actual generated wolfSSH `internal.c` compilation input to equal
+`tools/security_overrides.py`'s rendering of the pinned original, preprocesses
+that compile command (`-E -dM`), and checks this reviewed profile:
 
 - `LIBWOLFSSH_VERSION_HEX == 0x01004020` (1.4.20).
 - RSA disabled; ECDSA and Ed25519 not disabled.
@@ -23,8 +24,8 @@ checks this reviewed profile:
 
 For hosts without the ESP compiler/database, explicitly use `--host-only`.
 This prints a **SKIP** for production feature verification; it still checks the
-source/version/pin and executes the host contract with the reviewed feature
-profile. A stale compilation database is not proof of the next firmware build's
+source/version/pin and executes the rendered host contract with the reviewed
+feature profile. A stale compilation database is not proof of the next firmware build's
 configuration.
 
 ## What executes
@@ -39,8 +40,9 @@ reviewed SHA-256 of `managed_components/wolfssl__wolfssh/src/internal.c`:
 Any same-version source change fails before compilation. **Re-audit before
 updating this hash**; do not automatically bless a dependency update.
 
-The runner extracts actual function definitions by balancing braces after
-masking comments/string literals. It does not rewrite their bodies:
+The runner extracts actual **overridden production** function definitions by
+balancing braces after masking comments/string literals. Extraction does not
+rewrite their bodies; the separately verified build overlay does:
 
 - `GetBoolean`, `GetUint32`, `GetSize`, `GetStringRef`
 - `DoUserAuthRequestPassword`, `DoUserAuthRequestPublicKey`, `DoUserAuthRequest`
@@ -53,7 +55,7 @@ models, name/algorithm lookup, crypto and packet-output doubles. Binary request
 fixtures execute the extracted parsers; ordered event traces assert callback,
 hashing/signature and response order, rather than inspecting source substrings.
 
-The 35 cases cover:
+The 35 baseline cases cover (with the stricter malformed-password contract):
 
 - Ed25519 and ECDSA: signed authorization rejection (`INVALID_PUBLICKEY`,
   `FAILURE`, `REJECTED`, `INVALID_USER`, `INVALID_AUTHTYPE`) never hashes,
@@ -62,8 +64,8 @@ The 35 cases cover:
   probe sends PK_OK but does not complete authentication.
 - Bad signatures, good signatures, success-result veto, ignored failure-result
   callback return, and auth `WOULD_BLOCK`.
-- Password success/failure, rejected password change, and the installed parser's
-  callback on a truncated new-password-length field. No password result callback.
+- Password success/failure, rejected password change, and rejection **before the
+  callback** for a truncated new-password-length field. No password result callback.
 - Disabled `none`, unknown methods/key algorithms and truncated signed framing.
 - Direct keyboard-interactive dispatch invokes a **registered non-NULL rejecting
   prompt callback**, returns error and purges without preparing/building/sending
@@ -76,6 +78,15 @@ The 35 cases cover:
   prefix leaves the library copy intact. A blocked flush of earlier data returns
   a negative code without consuming new data.
 
+A further **100 generated-parser cases** test short/missing flags and lengths,
+truncated/oversized/`UINT32_MAX` password and replacement-password lengths,
+checked initial offsets and canaries, no callback on malformed fields, preserved
+username/service/method prefixes, and suffix wiping before response emission.
+They include success, invalid/backend/rejected outcomes, password changes, no
+callback, callback-modified credential pointers/lengths, and pending retry.
+`WS_AUTH_PENDING` deliberately preserves bytes; the project's synchronous
+callbacks do not use it. This is not an unconditional async secret-wipe promise.
+
 ## Limits / ownership
 
 This is a library parser/control-flow regression, **not application callback