fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/utils/audit-log.js

@@ -0,0 +1,59 @@
+/**
+ * SEC-25: structured security audit events (no secrets).
+ */
+import { randomBytes } from 'node:crypto'
+
+const SECRET_KEYS = /^(token|password|passphrase|authorization|cookie|authvalue|sso|bearer|secret|key)$/i
+
+/**
+ * @param {unknown} value
+ * @returns {unknown}
+ */
+export function redactValue(value) {
+  if (value == null) return value
+  if (typeof value === 'string') {
+    if (value.length > 64) return value.slice(0, 8) + '…(' + value.length + ')'
+    return value
+  }
+  if (Array.isArray(value)) return value.map(redactValue)
+  if (typeof value === 'object') {
+    const out = {}
+    for (const [k, v] of Object.entries(value)) {
+      if (SECRET_KEYS.test(k) || /token|password|cookie|secret|auth/i.test(k)) {
+        out[k] = '[redacted]'
+      } else {
+        out[k] = redactValue(v)
+      }
+    }
+    return out
+  }
+  return value
+}
+
+/**
+ * @param {object} event
+ * @param {{ logger?: Console }} [opts]
+ */
+export function audit(event, opts = {}) {
+  const logger = opts.logger || console
+  const row = {
+    ts: new Date().toISOString(),
+    type: 'uds-auth.audit',
+    correlationId: event.correlationId || randomBytes(8).toString('hex'),
+    action: event.action,
+    decision: event.decision || 'info',
+    reasonCode: event.reasonCode || null,
+    actor: event.actor || null,
+    target: event.target || null,
+    resource: event.resource || null,
+    service: event.service || 'uds-auth',
+    meta: event.meta ? redactValue(event.meta) : undefined,
+  }
+  const line = JSON.stringify(row)
+  if (event.decision === 'deny' || event.decision === 'error') {
+    logger.warn?.(line)
+  } else {
+    logger.info?.(line)
+  }
+  return row
+}