host: live writes via signed sessions + kernel multi-Set-Cookie (193/193)

Unblock the guarded blog write routes for browsers: a login form sets a
signed session cookie that the same routes accept (alongside Bearer), so
publishing works end-to-end on blog.rose-ash.com without Quart.

- kernel: http-listen emit serialises a response :set-cookies LIST as one
  Set-Cookie header each (a headers dict can't hold more than one). Purely
  additive — responses without :set-cookies are unchanged.
- server.sx: host/-dream->native forwards :set-cookies to the native resp.
- lib/host/session.sx: durable, signed sessions on the persist KV
  (session/create|exists|get|set|clear), wired via dream-sessions-signed.
- lib/host/auth.sx: GET/POST /login + POST /logout; host/require-user accepts
  a session principal OR a Bearer token.
- router.sx: host/make-app wraps the whole app in the session middleware and
  auto-mounts /login + /logout — the front door always has sessions.
- blog.sx: write routes use host/require-user; serve.sh flips POST /new from
  the experimental UNGUARDED route to the guarded write routes, with admin
  creds + signing secret + ACL grant from the container env.
- session conformance suite (12): login->cookie->guarded write 201; no
  cookie/forged/logged-out -> 401; Bearer fallback still works.

Verified live on blog.rose-ash.com: 401 unauthenticated, 303 login, 303
publish, anonymous read renders, post persists across container recreate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/host/conformance.sh

@@ -68,9 +68,12 @@ MODULES=(
   "lib/dream/auth.sx"
   "lib/dream/error.sx"
   "lib/dream/form.sx"
+  "lib/dream/session.sx"
   "lib/dream/router.sx"
   "lib/host/handler.sx"
   "lib/host/middleware.sx"
+  "lib/host/session.sx"
+  "lib/host/auth.sx"
   "lib/host/sxtp.sx"
   "lib/host/router.sx"
   "lib/host/feed.sx"
@@ -90,6 +93,7 @@ SUITES=(
   "feed        host-fd-tests-run!  lib/host/tests/feed.sx"
   "relations   host-rl-tests-run!  lib/host/tests/relations.sx"
   "blog        host-bl-tests-run!  lib/host/tests/blog.sx"
+  "session     host-se-tests-run!  lib/host/tests/session.sx"
   "page        host-pg-tests-run!  lib/host/tests/page.sx"
   "server      host-sv-tests-run!  lib/host/tests/server.sx"
   "ledger      host-lg-tests-run!  lib/host/tests/ledger.sx"