Harbour and portal health consumers

[bedipritpal]

Stage7: Harbour and portal consumers of the stage6 health backend, based on upstream8eab6ec2 afterPR191.

• Harbour OAds_ServerStats and own-management-handle OAds_ServerStatsRemote, complete JSON hash validation, null-to-NIL, wide counters and serialized MT lifecycle. Text and bounded console/CT-window display helpers plus native smoke fixtures; no default RDDADS management/data handle changes.
• Embedded Studio GET/api/server/health under the existing HTTP auth gate, no-store and manual Server-tab Refresh/count meanings/raw JSON. Readable health text after removing placeholder styling; no new listener/polling timer.
• DA-Web escaped health view, unavailable/null and unlimited-cap handling, correct32bit ADSHANDLE FFI ABI. Separate daemon-management credentials scoped to dictionary endpoint for20minutes; password cleared on submit, logout/expiry/endpoint/reconnect/disconnect invalidation and HTTPS browser-entry gate except loopback development.
• All ServerInfo JSONPOSTs require session CSRF, including existing kill/sql/locks; frontend carries token. Added sandbox portal/renderer regression fixtures and current documentation.

15files (+777/-14). No RDDADS core, lock/count-cache/OPENADS_FRESH_COUNTS change, daemon-hardening exemption, backend rewrite, workflow/CI/release change or parked items.

Compatibility: management remains plainTCP including credentials; browser-to-PHP HTTPS does not encrypt daemon leg. Existing Studio empty-user development mode and PHP session framework remain unchanged, not a new protected login system. DA-Web deploys separately. Direct ServerInfoPOST clients need GETtoken plus JSONCSRF. Harbour wrappers use8192byte buffers and hostname/IPv4 endpoints, not literalIPv6/URI; fail rather than truncate. Unknowns stay unavailable, never false zero.

Credit: scoped derivation from Pritpal Bedi's released mtfix41 source6dffce5805fe9bc3822d630f46ed02b26286206e, with completePOSTCSRF, readable Studio/unlimited DA display and added portal/renderer fixtures. No full-source identity claim.

Validation: fresh Linux normal/TLS ACE+serverd builds; normal combined182cases/10,115assertions. RealPHP8.1FFI sandbox fixtures pass normal/TLS auth/local+remotehealth/privacy/CSRF/nonJSON/expiry/endpoint/logout/nosession/wronglogin/HTTPSgate and Studioauth/no-store. ActualHarbourglue compiled; four concurrent own-handle remote callers/input/wronglogin pass normal/TLS; text/GT/realhbctCTwindow fixtures pass. StrictClangHTTPnormal/TLS+Cglue, PHPsyntax, JSparse and Nodeescaping/null/wide/zero/fallback pass. ActualStudio pixels and standalone actualDAhealth renderer inspected; browserlogin function verifies passwordclear/error/success. FullWindows32bitHarbour/macOS/fullCTest/hostedCI/fullDAdeployment not claimed