fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/session/factory.js

@@ -4,9 +4,10 @@ import { RedisStore } from './redis-store.js'
 /**
  * Factory function to create appropriate session store based on config
  * @param {object} config - Session configuration
+ * @param {{ file?: string, dataDir?: string, logger?: any }} [persist] - MemoryStore disk persistence
  * @returns {Promise<SessionStore>}
  */
-export async function createSessionStore(config) {
+export async function createSessionStore(config, persist = {}) {
   const { storeType, redisUrl } = config
   
   if (storeType === 'redis') {
@@ -18,10 +19,14 @@ export async function createSessionStore(config) {
     } catch (err) {
       console.error('[uds-auth] Failed to connect to Redis:', err.message)
       console.warn('[uds-auth] Falling back to MemoryStore')
-      return new MemoryStore()
+      const store = new MemoryStore(persist)
+      await store.init()
+      return store
     }
   }
   
-  // Default to memory store
-  return new MemoryStore()
+  // Default to memory store (persisted to the profile data dir when configured)
+  const store = new MemoryStore(persist)
+  await store.init()
+  return store
 }