fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/scripts/seal-local-admin.mjs

@@ -3,22 +3,93 @@
  * Generate UDS_AUTH_LOCAL_ADMIN_BOX for local decrypt-to-unlock admin.
  *
  * Usage:
- *   node scripts/seal-local-admin.mjs "your-passphrase-here"
+ *   node scripts/seal-local-admin.mjs
+ *   # prompts for passphrase on stdin (hidden when TTY)
+ *   node scripts/seal-local-admin.mjs --stdin   # read one line from stdin
  *
- * Then set the printed env on the Harness process (keep the passphrase offline).
+ * Passphrase on argv is rejected (R10) so it does not land in shell history.
  */
+import { createInterface } from 'node:readline'
+import { stdin as input, stdout as output, stderr } from 'node:process'
 import { sealLocalAdminBox, LOCAL_ADMIN_BOX_ENV } from '../lib/local-admin.js'
 
-const passphrase = process.argv[2]
-if (!passphrase) {
-  console.error('Usage: node scripts/seal-local-admin.mjs "<passphrase>"')
+async function readPassphrase() {
+  if (process.argv.includes('--stdin') || !process.stdin.isTTY) {
+    const rl = createInterface({ input, crlfDelay: Infinity })
+    const line = await new Promise((resolve) => {
+      rl.once('line', (l) => resolve(l))
+      rl.once('close', () => resolve(''))
+    })
+    rl.close()
+    return String(line || '').replace(/\r$/, '')
+  }
+  // Interactive: do not echo
+  stderr.write('Passphrase (input hidden): ')
+  return await new Promise((resolve, reject) => {
+    const wasRaw = input.isRaw
+    try { input.setRawMode?.(true) } catch { /* ignore */ }
+    input.resume()
+    let buf = ''
+    const onData = (chunk) => {
+      const s = chunk.toString('utf8')
+      for (const ch of s) {
+        if (ch === '\n' || ch === '\r' || ch === '\u0004') {
+          cleanup()
+          stderr.write('\n')
+          resolve(buf)
+          return
+        }
+        if (ch === '\u0003') {
+          cleanup()
+          reject(new Error('cancelled'))
+          return
+        }
+        if (ch === '\u007f' || ch === '\b') {
+          buf = buf.slice(0, -1)
+          continue
+        }
+        buf += ch
+      }
+    }
+    const cleanup = () => {
+      input.off('data', onData)
+      try { input.setRawMode?.(!!wasRaw) } catch { /* ignore */ }
+      input.pause()
+    }
+    input.on('data', onData)
+  })
+}
+
+if (process.argv[2] && process.argv[2] !== '--stdin') {
+  console.error('Do not pass the passphrase on argv (shell history risk).')
+  console.error('Usage: node scripts/seal-local-admin.mjs')
+  console.error('   or: echo passphrase | node scripts/seal-local-admin.mjs --stdin')
   process.exit(1)
 }
 
 try {
+  const passphrase = await readPassphrase()
+  if (!passphrase || passphrase.length < 12) {
+    console.error('Passphrase required (min 12 characters).')
+    process.exit(1)
+  }
   const box = sealLocalAdminBox(passphrase)
-  console.log(`# Keep the passphrase secret. Only the box goes into the process env.`)
+  console.log('# Keep the passphrase secret. Only the box goes into env and/or profile file.')
   console.log(`${LOCAL_ADMIN_BOX_ENV}=${box}`)
+  console.log('# Also durable for Desktop Host (often misses User env after reinstall):')
+  console.log(`#   write the box string into %USERPROFILE%\\.uds-auth\\local-admin.box`)
+  try {
+    const { writeFileSync, mkdirSync } = await import('node:fs')
+    const { homedir } = await import('node:os')
+    const { join } = await import('node:path')
+    const dir = join(homedir(), '.uds-auth')
+    mkdirSync(dir, { recursive: true })
+    const file = join(dir, 'local-admin.box')
+    writeFileSync(file, box + '\n', { encoding: 'utf8', mode: 0o600 })
+    console.log(`# Wrote ${file}`)
+  } catch (writeErr) {
+    console.error('# Could not write ~/.uds-auth/local-admin.box:', writeErr.message || writeErr)
+  }
 } catch (err) {
   console.error(err.message || err)
   process.exit(1)