fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/config.default.yaml

@@ -1,28 +1,19 @@
-# uds-auth 部署配置
-# 在 DSH 设置面板中可修改以下字段
-
-# UAC 基础 URL (生产: https://uac.zte.com.cn, 测试: http://uactest.zte.com.cn:8080)
+# uds-auth defaults — trusted single-instance (not strong multi-tenant)
 uacBaseUrl: https://uac.zte.com.cn
-
-# icenterapi 用户搜索接口 (完整 URL；须内网直连，禁止走 HTTP(S)_PROXY)
 userSearchUrl: https://icenterapi.zte.com.cn/zte-km-icenter-addresearch/user/plain/docs/search
-
-# 登录时传给 UAC 的业务系统 Code
 loginSystemCode: '100000455558'
-
-# 登录时传给 UAC 的来源系统 Code (留空则不传)
 originSystemCode: ''
-
-# Per-user workspaces under workspaceRoot/<empNo>; empty => $DSH_HOME/user-workspaces
-workspaceRoot: ""
-
-# Skill 凭证：UI 退出时是否保留（默认 true，供 cron/skill 继续用）
+workspaceRoot: ''
+# Explicit first super_admin when roles.json is empty (also: UDS_AUTH_INITIAL_ADMIN)
+initialAdminEmpNo: ''
+# When roles already exist, auto-register unknown UAC users as role=user
+allowOpenRegistration: true
+# Raw /agent-credentials token response (loopback) — off by default; prefer outbound + task capability
+allowRawAgentToken: false
 retainSkillCredentialsOnLogout: true
-
-# Skill 凭证 TTL（秒），默认 7 天
 skillCredentialTtlSeconds: 604800
-
-# outbound 白名单 hosts（逗号分隔）
 outboundAllowedHosts: icenterapi.zte.com.cn,icentermsg.dt.zte.com.cn
-
-# 兜底管理员默认在首次启动启用：administrator / Admin@123（roles.json 可改密或关闭）
+# Optional exact Host allowlist for /uds-auth writes; empty = Origin must match Host only
+trustedHosts: ''
+# Emergency fallback password is NOT enabled by default. Set via Settings (min 10 chars).
+# Legacy Admin@123 hashes are refused on upgrade.