httpd: keep the login sessions in bank 3

The web server's bank had no room left for the four sessions once the
original firmware's more robust header handling came in. Picking a slot,
checking a cookie and starting a session move to sessions.c in bank 3;
httpd.c only calls session_init(), session_check() and session_new().
The random id is written straight into the reply, which drops
gen_random_hex_chars() from bank 1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

sessions.h

@@ -0,0 +1,19 @@
+#ifndef _SESSIONS_H_
+#define _SESSIONS_H_
+
+#include <stdint.h>
+
+#define SESSIONS 4
+#define SESSION_ID_LENGTH 12
+
+extern __xdata char session_id[SESSIONS][SESSION_ID_LENGTH + 1];
+extern __xdata uint32_t last_session_use[SESSIONS];
+
+/* No session at boot */
+void session_init(void) __banked;
+/* Sets authenticated if the cookie in session belongs to a live session */
+void session_check(void) __banked;
+/* Starts a session at now and writes its id to outbuf at slen */
+void session_new(void) __banked;
+
+#endif