stp: drop the management failsafe

The window could be armed from the serial console but only ever disarmed
by an HTTP request. save_cmd, which gates arming, is cleared only while
execute_config() replays the startup config, so every interactive command
armed it wherever it was typed, while mgmt_alive, which disarms it, was
written in exactly one place, on HTTP traffic. An operator working
entirely on the serial console therefore lost STP 180 seconds after
enabling it however much they typed, which is what makes the mechanism
impossible to test from a console.

The documentation described the behaviour that was intended rather than
the one that was built, and in both directions: it said a command on the
serial console also confirms, and it said a reboot with STP in the
startup config disables it again three minutes later. Neither held. The
replay path never armed the window at all.

Repairing the asymmetry would have kept a mechanism whose premise is
contested anyway. A watchdog that switches the protection off in response
to silence adds a second failure mode on top of the first: where the
network is misconfigured and STP is the thing holding a storm back,
restoring forwarding removes the last reason management still answers.

Gone with it: the stp failsafe command, the fs and fsT fields of
/stp.json, the input and the tripped banner on the Spanning Tree page,
the two persistence patterns in config.js, the documentation section, and
mgmt_alive itself, which had no other reader.

550 bytes back, 145 of BANK1 and 405 of BANK2, and five of xdata, which
is the four counters and mgmt_alive and nothing else. Built for
SWTGW218AS and KP_9000_6XHML_X2 on sdcc 4.5.0.

doc/stp.md

@@ -9,10 +9,6 @@ silent, and blocks a port on which it sees its own BPDU.
 STP can be enabled and controlled via the web interface or the command line,
 as follows:
 
-> **Before you enable it on a switch you reach over the network**: read the
-> [management failsafe](#management-failsafe) section. The management VLAN
-> rides a port that STP can block.
-
 ## Quick start
 
 ```
@@ -123,41 +119,6 @@ claims a better priority.
 on the far side reacts badly to them (some unmanaged switches with loop
 prevention cut the link) but you still want STP on the rest of the ports.
 
-## Management failsafe
-
-Enabling STP on a switch you administer over the network is a genuine risk: the
-management VLAN rides a port that STP may put into blocking, and once that
-happens the way back is a power cycle.
-
-The firmware therefore runs a commit-confirm watchdog. Enabling STP, by hand or
-from the startup config, arms a one-shot window of `stp failsafe <seconds>`
-(default 180). One HTTP request inside the window confirms that management
-survived the new tree and disarms the watchdog until the next enable; a window
-with no management activity disables STP and restores forwarding. After the
-confirmation STP runs unsupervised, so a quiet network no longer loses its
-tree to three minutes of nobody looking at the web UI.
-
-```
-stp failsafe 180        # length of the armed window after enabling (0 = never armed)
-```
-
-Any later event that newly takes a port out of forwarding arms the window
-again: a port rejoining via `stp port <n> on`, root guard firing, the loop
-latch. If management traffic keeps flowing past the new block, the very next
-request confirms and disarms; if the block cut it, the silent window restores
-forwarding as above. A stable network with nothing newly blocked never re-arms.
-
-A command executed on the serial console also confirms, on the grounds that an
-operator with out-of-band access does not need the automatic restore; the
-command that enabled STP does not count, only activity after it.
-
-A headless switch that nobody confirms over HTTP should set `stp failsafe 0`,
-otherwise a reboot with STP in the startup config disables it again three
-minutes later. Setting a new value while STP runs arms a fresh window.
-
-The status page shows whether the failsafe has tripped since STP was last
-enabled.
-
 ## Status
 
 The Spanning Tree page shows the elected root (priority and MAC), the path cost