fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/lib/utils/read-body.js

@@ -0,0 +1,49 @@
+/**
+ * SEC-23: bounded body readers.
+ */
+export const DEFAULT_MAX_BODY = 256 * 1024
+export const MAX_QR_PROXY_BODY = 64 * 1024
+export const MAX_QR_DATA_LEN = 2048
+
+/**
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{ maxBytes?: number }} [opts]
+ * @returns {Promise<string>}
+ */
+export async function readBodyLimited(req, opts = {}) {
+  const maxBytes = opts.maxBytes ?? DEFAULT_MAX_BODY
+  const chunks = []
+  let total = 0
+  for await (const chunk of req) {
+    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    total += buf.length
+    if (total > maxBytes) {
+      const err = new Error('payload_too_large')
+      err.code = 'payload_too_large'
+      err.statusCode = 413
+      // Drain remaining to free the socket (best-effort).
+      try { req.resume() } catch { /* ignore */ }
+      throw err
+    }
+    chunks.push(buf)
+  }
+  return Buffer.concat(chunks).toString('utf8')
+}
+
+/**
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{ maxBytes?: number }} [opts]
+ * @returns {Promise<object>}
+ */
+export async function readJsonBodyLimited(req, opts = {}) {
+  const raw = await readBodyLimited(req, opts)
+  if (!raw) return {}
+  try {
+    return JSON.parse(raw)
+  } catch {
+    const err = new Error('invalid_json')
+    err.code = 'invalid_json'
+    err.statusCode = 400
+    throw err
+  }
+}