fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/package.json

@@ -1,9 +1,12 @@
 {
   "name": "uds-auth",
-  "version": "0.2.21",
-  "description": "UDS authentication plugin for DeepSeek Harness with multi-tenant session isolation",
+  "version": "0.3.15",
+  "description": "UDS authentication plugin for DeepSeek Harness — trusted single-instance access control (not strong multi-tenant isolation)",
   "type": "module",
   "main": "lib/index.js",
+  "bin": {
+    "uds-auth-seal-local-admin": "./scripts/seal-local-admin.mjs"
+  },
   "exports": {
     ".": "./lib/index.js",
     "./client": "./lib/client.js",
@@ -18,8 +21,10 @@
   },
   "scripts": {
     "bundle:qrcode": "bun run scripts/bundle-qrcode.mjs",
-    "prepack": "bun run scripts/bundle-qrcode.mjs",
-    "test": "node --test test/**/*.test.js"
+    "prepack": "bun run scripts/bundle-qrcode.mjs && node scripts/generate-sbom.mjs",
+    "pack:check": "node scripts/pack-check.mjs",
+    "test": "node --test test/**/*.test.js",
+    "sbom": "node scripts/generate-sbom.mjs"
   },
   "keywords": [
     "dsh-plugin",
@@ -28,13 +33,14 @@
     "authentication",
     "uds",
     "sso",
-    "session-management",
-    "multi-tenant"
+    "session-management"
   ],
   "files": [
     "lib",
     "skills",
     "skill-helpers",
+    "scripts/seal-local-admin.mjs",
+    "scripts/pack-check.mjs",
     "config.default.yaml",
     "cordis.patch.yml",
     "docs",
@@ -45,7 +51,7 @@
   "author": "",
   "license": "MIT",
   "engines": {
-    "node": ">=18.0.0"
+    "node": "^22.19.0 || >=24.0.0"
   },
   "dependencies": {},
   "devDependencies": {