feat!: the token on every route, Secure Config Only goes (step 4b)

Under Secured every HTTP route but the public ones needs the token
(docs/adr/0006-two-security-modes-eleven-http-routes.md):
- isPublicRoute, isWebAsset and originMatchesHost in src/HttpAccess.h,
  with native tests.
- One middleware checks the token. It runs once the body is in, so
  /restore, /updateFirmware and /updateApplication check it on their
  first chunk and drop a refused upload.
- Static serving answers the web UI's files only: shades.cfg and
  shades.tmp are no longer served.
- The wildcard CORS headers go; WEB_CORS turns them back on for UI work
  from file://.
- The socket refuses a handshake whose Origin doesn't name its Host.
- "Secure Config Only" goes: a device set to it is Secured, and
  /loginContext drops permissions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

platformio.ini

@@ -42,6 +42,10 @@ build_flags =
 	; Route log_printfv through src/LogLock.cpp so lines from both cores don't
 	; interleave.  The core already wraps log_printf for ESP Insights.
 	-Wl,--wrap=log_printfv
+	; For work on the web UI from a file:// page (baseUrl in index.js): sends
+	; the CORS headers and lets the socket skip its Origin check.  Never in a
+	; release (docs/SECURITY_PLAN.md, CORS).
+	; -DWEB_CORS
 monitor_speed = 115200
 monitor_filters = 
 	time