fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/utils/rate-limit.js

@@ -0,0 +1,58 @@
+/**
+ * SEC-23: simple in-memory rate limiter with bucket cleanup.
+ * Keyed by real socket address (not XFF).
+ */
+
+export class RateLimiter {
+  /**
+   * @param {{ windowMs?: number, max?: number, maxBuckets?: number }} [opts]
+   */
+  constructor(opts = {}) {
+    this._windowMs = opts.windowMs ?? 60_000
+    this._max = opts.max ?? 30
+    this._maxBuckets = opts.maxBuckets ?? 10_000
+    /** @type {Map<string, { count: number, resetAt: number }>} */
+    this._buckets = new Map()
+    this._sweepTimer = setInterval(() => this._sweep(), Math.max(this._windowMs, 30_000))
+    if (typeof this._sweepTimer.unref === 'function') this._sweepTimer.unref()
+  }
+
+  _sweep() {
+    const now = Date.now()
+    for (const [k, b] of this._buckets) {
+      if (now > b.resetAt) this._buckets.delete(k)
+    }
+  }
+
+  /**
+   * @param {string} key
+   * @returns {boolean} true if allowed
+   */
+  allow(key) {
+    const id = String(key || 'unknown')
+    const now = Date.now()
+    let bucket = this._buckets.get(id)
+    if (!bucket || now > bucket.resetAt) {
+      if (this._buckets.size >= this._maxBuckets) this._sweep()
+      if (this._buckets.size >= this._maxBuckets) {
+        // Evict oldest-ish entry
+        const first = this._buckets.keys().next().value
+        if (first != null) this._buckets.delete(first)
+      }
+      bucket = { count: 0, resetAt: now + this._windowMs }
+      this._buckets.set(id, bucket)
+    }
+    bucket.count++
+    return bucket.count <= this._max
+  }
+
+  dispose() {
+    clearInterval(this._sweepTimer)
+    this._buckets.clear()
+  }
+}
+
+export function clientKey(req) {
+  const ra = req?.socket?.remoteAddress || 'unknown'
+  return String(ra).replace(/^::ffff:/i, '')
+}