fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/docs/uds-skill-auth.zh.md

@@ -12,9 +12,11 @@ uds-auth/skills/uds-skill-auth/
 
 1. 安装 uds-auth 插件  
 2. 把 `uds-auth/skills/uds-skill-auth` 配进 Harness 的 skills 目录（或复制到工作区 `skills/uds-skill-auth`）  
-3. 用户扫码登录  
+3. 用户扫码登录（或由 Host 为 cron 注入 `UDS_TASK_CAPABILITY`）  
 4. 业务 skill 通过 sibling / skills 根找到本 skill 的 `scripts/`
 
+推荐：**优先** `request()` / outbound；原始 `resolve()` 依赖 `allowRawAgentToken`（默认关闭）。后台任务使用 `UDS_TASK_CAPABILITY`，不要依赖浏览器 Cookie。
+
 ## 业务 skill 引用
 
 ```python
@@ -33,8 +35,10 @@ def load_uds_skill_auth():
 
 | 函数 | 用途 |
 |------|------|
-| `resolve()` | `POST /uds-auth/agent-credentials` → empNo+token |
-| `request(method, url, ...)` | `POST /uds-auth/outbound` 出站代贴鉴权 |
+| `resolve()` | 原始凭证（需显式开启 raw；可带 `UDS_TASK_CAPABILITY`） |
+| `request(method, url, ...)` | `POST /uds-auth/outbound`（推荐；支持 task capability） |
 | `UdsAuthError` | 未登录 / 连不上 Host 等 |
 
+环境变量：`DSH_SESSION_ID`、`UDS_TASK_CAPABILITY`（Host `mintTaskCapability` 签发）。
+
 完整契约：[skill-auth-standard.zh.md](./skill-auth-standard.zh.md)