Web UI login with the kiosk's PIN/password; shortcuts list on the Sites page

When the kiosk's password protection is on, the Web UI now asks for the same
PIN/password the lock screen uses: random session cookie (12 h, HttpOnly,
SameSite=Strict), the lock screen's wrong-code slowdown, sessions end when
the kiosk's code changes, sign out. With protection off nothing changes.
The Sites page (Web UI and terminal menu) lists the back/forward/home and
site-switching keys.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013wi3ZQveYdjfcrEsyazq32

webui/test/api.test.js

@@ -18,6 +18,20 @@ process.env.WIFI_HELPER_PATH = path.join(__dirname, 'fixtures', 'fake-wifi-helpe
 
 const app = require('../server');
 
+// These tests turn password protection on partway through, and the Web UI
+// then (correctly) wants a login. A browser keeps the session cookie the
+// server hands out on a save; Node's fetch doesn't, so keep it here.
+const nodeFetch = global.fetch;
+let sessionCookie = '';
+global.fetch = async (url, opts = {}) => {
+    const headers = { ...(opts.headers || {}) };
+    if (sessionCookie) headers.cookie = sessionCookie;
+    const res = await nodeFetch(url, { ...opts, headers });
+    const set = res.headers.get('set-cookie');
+    if (set) sessionCookie = set.split(';')[0];
+    return res;
+};
+
 let failures = 0;
 async function check(label, fn) {
     try {