fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/test/host-context.test.js

@@ -2,6 +2,7 @@ import assert from 'node:assert/strict'
 import test from 'node:test'
 import { getUserContext, runAsHost, withUserContext } from '../lib/context.js'
 import { installDshAcl } from '../lib/dsh-acl.js'
+import { MemoryStore } from '../lib/session/memory-store.js'
 
 test('Host callback context is isolated across concurrent browser identities and exceptions', async () => {
   const identities = [null, { empNo: 'u1' }, { empNo: 'u2' }]
@@ -22,6 +23,8 @@ test('Host callback context is isolated across concurrent browser identities and
 test('trusted Host creation works from browser ALS while unauthenticated browser creation stays denied', async () => {
   let creations = 0
   const owners = []
+  const sessionStore = new MemoryStore()
+  const minted = await sessionStore.create({ empNo: 'u1' }, 600)
   const controller = {
     async list() { return { items: [] } },
     async search() { return { items: [] } },
@@ -41,6 +44,7 @@ test('trusted Host creation works from browser ALS while unauthenticated browser
     userWorkspaces: { isUserPath: (empNo, path) => path === `/ws/${empNo}`, get() { return null } },
     getWorkspaceRoot: () => '/ws',
     getWorkspaceRegistry: () => undefined,
+    getSessionStore: () => sessionStore,
   })
   await withUserContext(null, async () => {
     await assert.rejects(controller.create({ cwd: '/bot' }), error => (
@@ -53,7 +57,11 @@ test('trusted Host creation works from browser ALS while unauthenticated browser
   })
   assert.equal(creations, 1)
   assert.deepEqual(owners, [], 'background sessions must not inherit a browser owner')
-  await withUserContext({ empNo: 'u1', permissions: {} }, async () => {
+  await withUserContext({
+    empNo: 'u1',
+    sessionId: minted.sessionId,
+    permissions: {},
+  }, async () => {
     await assert.rejects(controller.create({ cwd: '/other' }), error => (
       error.details.udsError === 'session_workspace_only'
     ))