fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/skills/uds-skill-auth/SKILL.md

@@ -23,12 +23,12 @@ uds-auth/skills/uds-skill-auth/
 
 ## 给其它 Skill 用
 
-业务 skill 的 Python 脚本里，把本 skill 的 `scripts/` 加入 `sys.path` 后：
+业务 skill 的 Python 脚本里，把本 skill 的 `scripts/` 加入 `sys.path` 后。**推荐**走 `request()`（outbound）；`resolve()` 仅在 Host 开启 `allowRawAgentToken` 且任务注入了 `credentials` scope 的 `UDS_TASK_CAPABILITY` 时可用。
 
 ```python
-from uds_skill_auth import resolve, request, UdsAuthError
+from uds_skill_auth import request, UdsAuthError
 
-creds = resolve()
+# 需要环境：DSH_SESSION_ID +（推荐）UDS_TASK_CAPABILITY
 out = request("POST", "https://icenterapi.zte.com.cn/...", headers={...}, body={...})
 ```
 
@@ -51,10 +51,11 @@ def load_uds_skill_auth():
 
 也可设置 `UDS_AUTH_HELPERS` 指向本 skill 的 `scripts` 绝对路径。
 
-## 环境变量（Agent 已注入，勿教模型打印密钥）
+## 环境变量（Agent / 任务注入，勿教模型打印密钥）
 
 - `DSH_SESSION_ID`
 - `DSH_WEB_URL`
+- `UDS_TASK_CAPABILITY`（Host `mintTaskCapability`；scopes 按任务最小授权）
 
 ## 标准文档