Move File Transfer's 6-digit code and its lockout (3 wrong tries = 30 s)
into a header-only WebAuthCode with one global, g_web_auth, so the other
browser features can use the same code. WebFileTransfer and drainFileInput
now call it. No behaviour change.
Adds test/test_web_auth_code.cpp (host g++).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Signed-off-by: CarpeNoctem <cryptomax@pm.me>
