fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/config.js

@@ -24,6 +24,11 @@ const DEFAULT_CONFIG = {
   retainSkillCredentialsOnLogout: true,
   skillCredentialTtlSeconds: 7 * 24 * 60 * 60,
   outboundAllowedHosts: 'icenterapi.zte.com.cn,icentermsg.dt.zte.com.cn',
+  initialAdminEmpNo: '',
+  allowOpenRegistration: true,
+  allowRawAgentToken: false,
+  /** Empty = loopback Host only; reverse proxies must set explicit authorities. */
+  trustedHosts: '',
 }
 
 // 内部常量（不暴露）
@@ -56,5 +61,13 @@ export function buildVerifyUrl(uacBaseUrl, uacQrVerifyPath) {
 
 export function validateConfig(config) {
   if (!config?.uacBaseUrl) throw new Error('uacBaseUrl is required')
+  const checkHttps = (v, name) => {
+    if (v == null || v === '') return
+    let u
+    try { u = new URL(String(v)) } catch { throw new Error(`invalid_${name}`) }
+    if (u.protocol !== 'https:') throw new Error(`${name}_must_be_https`)
+  }
+  checkHttps(config.uacBaseUrl, 'uacBaseUrl')
+  checkHttps(config.userSearchUrl, 'userSearchUrl')
   return true
 }