Harden WebSocket handshake and frame handling

[Distortions81]

Summary

Harden the WebSocket receive and handshake paths before a client is accepted.

• Bound ignored inbound frames at 1 KiB and drain them through fixed stack storage instead of allocating from a peer-provided length.
• Require a browser Origin to match Host, while preserving origin-less CLI clients.
• Perform LAN eligibility, endpoint-type, and mutex-protected capacity checks before the upgrade.
• Test payload and Origin/Host parser boundaries.

Why

Previously, rejection happened after the HTTP upgrade and ignored application frames caused peer-sized heap allocation. This change makes both paths fail closed without changing the trusted-network model or adding authentication.

Review follow-up

Incorporates @johnny9's requested coverage for case-insensitive schemes, bracketed IPv6, query/fragment suffixes, malformed ports, empty authority/Host, and absent schemes.

The branch is rebased onto the ESP-IDF 6 upgrade on master, retaining upstream's pre/post-handshake lifecycle.

Stack and related work

First in the cumulative HTTP hardening series; #1847 and #1848 build on it. Related to #1845, with this draft additionally covering pre-handshake same-origin and race-safe capacity checks.

Validation

• ESP-IDF 6.0.2 ESP32-S3 test image built
• Exact CI QEMU environment: 74 passed, 0 failed
• Full firmware build passed at cumulative tip Harden HTTP request body and upload handling #1848
• git diff --check

[github-actions]

Test Results

  2 files  ±0    2 suites  ±0   0s ⏱️ -1s
120 tests ±0  120 ✅ ±0  0 💤 ±0  0 ❌ ±0 
122 runs  ±0  122 ✅ ±0  0 💤 ±0  0 ❌ ±0 

Results for commit 9c5e283. ± Comparison against base commit c32b52d.

♻️ This comment has been updated with latest results.

[johnny9]

Reviewed exact head 4103bfd. I did not find a correctness defect in the changed handshake/frame logic. The remaining issue is incomplete boundary coverage for the new Origin/Host policy. The proposed test-only patch applies cleanly and the full ESP32-S3 QEMU suite remains green: 76 tests, 0 failures.

[johnny9]

Physical Bitaxe 602 smoke test passed on head 40161f9a56b3f3d66c332908b6aa64b07a03e90d.

The application-only OTA reported the expected firmware version, the device returned to healthy mining with three stable API samples, zero fault indication, and the configured pool intact. An independent authorized Stratum V1 probe received a fresh mining.notify. The 602 has no separate bridge firmware, so no bridge image was applied.

Full test result and artifacts: https://mining-qa-status.vercel.app/results/c9de3189-270a-428f-95c2-2e254f1dda70

Test harness: johnny9/miner-testcode@b3694f6b01617baa8b71ed84c28300baf4cdab61.