fix(uds-auth): emergency login workspaces, Desktop key prompts, persistent sessions

Emergency (fallback / sealed-box) admins lost the workspace sidebar and saw
"sign-in failed / add API key" on DSH Desktop because the remote.mux opens
anonymously at boot and every early call was rejected terminally.

- gateway: anonymous workspace/follow reaches dsh-acl's empty baseline;
  anonymous streams are parked until the carrier aborts instead of failing;
  anonymous workspace/initializeDefault answers "nothing created"
- request-auth: a dead UDS_SESSION cookie no longer shadows a valid WS ticket
  or bridge (sync + async variants used by all callers)
- dsh-acl: /api/* waits (bounded 15s) for the gateway ACL during Host startup
  instead of 403, so the Desktop welcome read no longer fails
- desktop-bootstrap: key/account projection is best-effort per reference
- client: emit connection/reset after login so boot-time caches (settings
  describe mirror -> Settings > Models) re-read under the real principal
- sessions: absolute lifetime fixed at 7 days (was min(ttl, 7d) = 30 min);
  bridge expiry slides with its session; MemoryStore persisted to
  sessions.json (bearer hash only, userData AES-256-GCM sealed)
- README: session lifetime/persistence and DSH compatibility notes

Also includes previously uncommitted uds-auth 0.3.x work in this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

uds-auth/test/local-admin.test.js

@@ -1,5 +1,8 @@
 import { describe, it, after } from 'node:test'
 import assert from 'node:assert/strict'
+import { mkdirSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
 import {
   LOCAL_ADMIN_BOX_ENV,
   LOCAL_ADMIN_ENV,
@@ -38,6 +41,8 @@ describe('local-admin sealed box', () => {
 
   it('env box alone does not imply auto-login; only configures unlock', () => {
     delete process.env[LOCAL_ADMIN_BOX_ENV]
+    // Isolate from a developer machine's ~/.uds-auth/local-admin.box
+    process.env.UDS_AUTH_DATA_DIR = join(tmpdir(), `uds-auth-box-${Date.now()}`)
     assert.equal(isLocalAdminBoxConfigured(), false)
 
     const box = sealLocalAdminBox('another-strong-key')
@@ -50,4 +55,17 @@ describe('local-admin sealed box', () => {
     const stillNeedDecrypt = openLocalAdminBox(box, process.env[LOCAL_ADMIN_ENV])
     assert.equal(stillNeedDecrypt.ok, false)
   })
+
+  it('reads sealed box from profile local-admin.box when env is unset', () => {
+    delete process.env[LOCAL_ADMIN_BOX_ENV]
+    const dir = join(tmpdir(), `uds-auth-box-file-${Date.now()}`)
+    mkdirSync(dir, { recursive: true })
+    process.env.UDS_AUTH_DATA_DIR = dir
+    assert.equal(isLocalAdminBoxConfigured(), false)
+
+    const box = sealLocalAdminBox('file-backed-passphrase')
+    writeFileSync(join(dir, 'local-admin.box'), box, 'utf8')
+    assert.equal(isLocalAdminBoxConfigured(), true)
+    assert.equal(readLocalAdminBox(), box)
+  })
 })