fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/session/store.js

@@ -1,22 +1,89 @@
 /**
- * Session store — 单索引: empNo → userData
- * 
- * 一个工号 = 一个会话，不需要 sessionId，不需要额外 cookie。
- * 多终端同工号自动共享同一个会话条目。
+ * Auth session store — opaque sessionId + random bearer.
+ * empNo is an attribute / secondary index, never the auth credential.
  */
 export class SessionStore {
-  /** 按 empNo 获取会话 */
-  async get(empNo) { throw new Error('SessionStore#get must be implemented') }
-  /** 按 empNo 存储会话 */
-  async set(empNo, userData) { throw new Error('SessionStore#set must be implemented') }
-  /** 按 empNo 存储并设置过期(秒) */
-  async setex(empNo, seconds, userData) { throw new Error('SessionStore#setex must be implemented') }
-  /** 按 empNo 删除会话 */
-  async delete(empNo) { throw new Error('SessionStore#delete must be implemented') }
-  /** 检查 empNo 是否存在 */
-  async has(empNo) { throw new Error('SessionStore#has must be implemented') }
-  /** 清空所有会话 */
-  async clear() { throw new Error('SessionStore#clear must be implemented') }
-  /** 列出所有活跃会话 */
-  async keys() { throw new Error('SessionStore#keys must be implemented') }
+  /**
+   * Create a verified session.
+   * @param {object} userData
+   * @param {number} ttlSeconds
+   * @returns {Promise<{ sessionId: string, bearer: string, record: object }>}
+   */
+  async create(userData, ttlSeconds) {
+    throw new Error('SessionStore#create must be implemented')
+  }
+
+  /** Lookup by bearer token (proof of possession). */
+  async getByBearer(bearer) {
+    throw new Error('SessionStore#getByBearer must be implemented')
+  }
+
+  /** Sync lookup for WS upgrade paths. */
+  getByBearerSync(bearer) {
+    throw new Error('SessionStore#getByBearerSync must be implemented')
+  }
+
+  async getBySessionId(sessionId) {
+    throw new Error('SessionStore#getBySessionId must be implemented')
+  }
+
+  async touch(sessionId, ttlSeconds) {
+    throw new Error('SessionStore#touch must be implemented')
+  }
+
+  async revokeSession(sessionId) {
+    throw new Error('SessionStore#revokeSession must be implemented')
+  }
+
+  async revokeBearer(bearer) {
+    throw new Error('SessionStore#revokeBearer must be implemented')
+  }
+
+  /** Revoke all devices for an empNo. */
+  async revokeEmpNo(empNo) {
+    throw new Error('SessionStore#revokeEmpNo must be implemented')
+  }
+
+  /** Profile cache only — never proves authentication. */
+  async setProfile(empNo, profile) {
+    throw new Error('SessionStore#setProfile must be implemented')
+  }
+
+  async getProfile(empNo) {
+    throw new Error('SessionStore#getProfile must be implemented')
+  }
+
+  async clear() {
+    throw new Error('SessionStore#clear must be implemented')
+  }
+
+  // --- legacy compat shims (empNo-keyed) — prefer create/getByBearer ---
+
+  /** @deprecated use getByBearer */
+  async get(empNo) {
+    throw new Error('SessionStore#get must be implemented')
+  }
+
+  /** @deprecated use create */
+  async setex(empNo, seconds, userData) {
+    throw new Error('SessionStore#setex must be implemented')
+  }
+
+  /** @deprecated use revokeEmpNo */
+  async delete(empNo) {
+    throw new Error('SessionStore#delete must be implemented')
+  }
+
+  async has(empNo) {
+    throw new Error('SessionStore#has must be implemented')
+  }
+
+  async keys() {
+    throw new Error('SessionStore#keys must be implemented')
+  }
 }
+
+export const SESSION_COOKIE = 'UDS_SESSION'
+export const SESSION_HEADER = 'x-uds-session'
+/** Absolute session lifetime; idle expiry (cookieMaxAge) slides within it. */
+export const SESSION_ABSOLUTE_MAX_SECONDS = 7 * 24 * 60 * 60