fix: review findings on the token key

- Load the token key in Web::startup(), before either web server starts,
  so no token can be made with the all-zero key; log a failed
  pref.begin().
- createAPIToken checks mbedtls' return codes. On a failure it leaves
  the token empty, which tokenMatches never accepts, instead of hex
  from uninitialised stack.
- API_TOKEN_SIZE in ApiToken.h replaces the five char[65] buffers; the
  HMAC's description moves to createAPIToken, with the None form.
- handleLogin builds the candidate token once and compares it once.
- e2e: the serverId test skips on `secured` like its neighbours, names
  its values, and says it assumes the device sees this PC's address.
- KNOWN_ISSUES keeps #81, which #108 removes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/ApiToken.h

@@ -3,14 +3,16 @@
 #include <stddef.h>
 #include <stdint.h>
 
-// A token is HMAC-SHA256(token key, PIN or username:password + ":" + client
-// IP) in hex.  The token key is 32 random bytes the device makes on first boot
-// and keeps in NVS: it never leaves the device.
+// The token key's size: 32 random bytes the device makes on first boot and
+// keeps in NVS.  It never leaves the device.
 #define API_TOKEN_KEY_SIZE 32
+// A token's buffer: an HMAC-SHA256 in hex and its terminator.
+#define API_TOKEN_SIZE 65
 
 // True when given is the expected token.  It takes the same time whatever
 // given holds, so the time doesn't tell how much of a guess was right.  Only
-// expected's length shows, and every token has the same one.
+// expected's length shows, and every token has the same one.  An empty
+// expected token, which is what a failed HMAC leaves, matches nothing.
 inline bool tokenMatches(const char *expected, const char *given) {
   if(!expected || !given || !expected[0]) return false;
   uint8_t diff = 0;