Add Bounded Web Admission Diagnostics

src/web_diagnostics.h

@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-3.0-only */
+#pragma once
+
+#include "esp_https_server.h"
+
+typedef enum {
+    WEB_DIAG_SERIAL_TICKET,
+    WEB_DIAG_ADMIN_TICKET,
+    WEB_DIAG_SERIAL_UPGRADE,
+    WEB_DIAG_ADMIN_UPGRADE,
+} web_diag_route_t;
+
+/* Synchronous HTTPD-owner callbacks only; no socket/context ownership transfer. */
+void web_diagnostics_tls(esp_https_server_user_cb_arg_t *arg);
+esp_err_t web_diagnostics_handler(httpd_req_t *request, web_diag_route_t route,
+                                  esp_err_t (*handler)(httpd_req_t *));
+/* Canonical console dispatcher only. No HTTPD calls or network waits. */
+int web_diagnostics_command(const char *action);