refactor(web): extract console/spa-mount/ws-auth mixins from web_server.py (shard s5 union)

[andrexibiza]

Shard S5 extraction of web_server.py

5×2×3 blind-witness large-file decomposition, wave-3-verified. Byte-fidelity extraction, zero behavior change.

Related #78791 #78792 #77376 #77746 #77748 #77751 #77752 #77756 #77759 #79066 #79067 #79068 #79069 #79070 #79392 #79393 #79394 #79395 #79396 #79547 #79548 #79549 #79550 #79551 #79593 #79594 #79595 #79596 #79597 #79613 #79614 #79615 #79616 #79617 #79658 #79659 #79660 #79661 #79662 #79670 #79672 #79673 #79674 #79675 #79706 #79708 #79709 #79710 #79711

[spfcraze]

This was generated by AI during triage.

Summary:
This PR duplicates the WhatsApp onboarding extraction already carried by open PR #79774 — both add a byte-identical hermes_cli/web_routers/whatsapp_onboarding.py and remove the same four onboarding routes from web_server.py.

Problems:

• hermes_cli/web_routers/whatsapp_onboarding.py is added as a new file here and in refactor(web): extract files/fs mixins from web_server.py (shard s1) #79774 with identical content (both 529 lines, same sha256), and tests/test_web_server_whatsapp_seam.py is likewise added identically in both.
• Both PRs remove the same four /api/messaging/whatsapp/onboarding routes from hermes_cli/web_server.py and wire the same app.include_router(_whatsapp_routes.router); the two PRs share the same merge-base with main.
• Neither PR body references the other, so the overlap is invisible from either thread alone.

Solution:
Drop the whatsapp slice from one of the two PRs (the other already carries it verbatim) so the shard series does not ship the R4-C3 cluster twice.

---

Checked against e19371c — the tip of gfg/webserver-extract-s5-w1a when this was written.

[andrexibiza]

Fixed in 2aece10 — the WhatsApp R4-C3 slice is dropped from this branch. hermes_cli/web_routers/whatsapp_onboarding.py and tests/test_web_server_whatsapp_seam.py are removed and hermes_cli/web_server.py is restored to the s5-union-only state, so the cluster ships exactly once, via #79774 (which still carries it verbatim at 096df1e). The compare range for this PR is now 7 files: the console/spa-mount/ws-auth mixins and their tests only; the four onboarding routes remain in web_server.py here.

Validation on head 2aece10:

• 79 passed via scripts/run_tests.sh (test_spa_mount_mixin 12, test_ws_auth_gate_mixin 24, test_web_server_ws_auth_extraction 43)
• git diff --check clean; all three mixin modules import cleanly from web_server
• CI green on the head: 12/12 test slices, ruff + ty diff, Windows footguns (blocking), e2e, supply-chain scan