feat: graduate Host Console to Community admins (#1669)

* feat: graduate Host Console to Community admins

Make Host Console available to Community and Admiral admins (system:console), add host-console-community for mixed fleets, and keep opaque API tokens off the host shell.

* docs: document Host Console deep links

Cover root and stack-scoped Console URLs, correct the phone treatment note, and pin parse/build round-trips in senchoRoute tests.

* fix: bind Host Console socket to the resolved node

Treat unresolved activeNode as loading, target the WebSocket with an explicit nodeId, and wait for stack deep-link hydration so the shell cannot open on the wrong node or compose root. Add regression coverage for node/stack retargeting and fail-closed directory resolution.

* fix: harden Host Console node binding, audit acting_as, and console_session tokens

Reject unknown or malformed nodeIds before spawning a PTY. Record hub operators in audit_log.acting_as for remote console_session bridges. Path-scope and one-time-consume console_session JWTs so Host Console mints cannot open container exec or be replayed.

* test: expect acting_as in audit CSV export header

Align the CSV export assertion with the P0-2B acting_as column added to audit log exports.

backend/src/websocket/generic.ts

@@ -54,9 +54,10 @@ export function handleGenericWs(
   if (isProxyToken) return reject(socket, 403, 'Forbidden');
 
   // Admin enforcement: container exec requires admin role.
-  // console_session tokens are already admin-gated at creation time.
-  // API tokens reaching this point have full-admin scope (read-only /
-  // deploy-only are blocked by the upgrade handler's scope gate).
+  // console_session tokens are already admin-gated at creation time and
+  // path/jti-gated in upgradeHandler. API tokens reaching this point have
+  // full-admin scope (read-only / deploy-only are blocked by the upgrade
+  // handler's scope gate).
   if (!decoded.scope) {
     const execUser = decoded.username ? DatabaseService.getInstance().getUserByUsername(decoded.username) : undefined;
     if (!execUser) {