Auth model cleanup (post-4.0.0): rename HTTPCGI -> route type; retire the global LOGIN bitmask

[mgrossmann]

Context

The per-route auth policy (#98) landed the last of the httpd-side auth-redesign steps (epic #100). Two internal cleanups were deliberately deferred out of #98 to keep that change focused and backward-compatible; this issue tracks them so they aren't forgotten after the 4.0.0 release.

Both are pure tech debt — the current code is correct and safe. Neither is on the critical path (that runs through mvsMF: mvslovers/mvsmf#162, #161).

---

Task 1 — Rename HTTPCGI to a neutral route type

What. Rename the HTTPCGI struct (and its friends) to a route-oriented name, e.g. HTTPROUTE / route:

• struct httpcgi → struct httproute; HTTPCGI typedef; HTTPCGI_EYE "HTTPCGI" eye-catcher.
• httpd->httpcgi[] array field and the route/cgi locals that walk it.
• The registrar/lookup surface: httpacgi()/http_add_cgi, httpfcgi()/http_find_cgi, and their callers.

Why. Since #98 the struct no longer models only a CGI: a LOC= entry has pgm == NULL and represents a program-less static route carrying auth policy. HTTPCGI is now a misnomer — a reader sees http_find_cgi() returning a "CGI" for a plain static path and a ->pgm that may be NULL. A neutral route name makes the two-kinds-of-route model (MOD= with a program, LOC= without) self-documenting and removes the NULL-pgm surprise.

When. After 4.0.0 ships. It's cosmetic/internal and can happen any time; it does not wait on any other work.

Scope / caveats.

• http_find_cgi / http_add_cgi / http_process_cgi sit in the HTTPX vector (offsets 0x100/0x104/0x108) and are exposed to CGI modules via httpcgi.h macros. Vector offsets and asm() names must not change (append-only ABI). So this is a source rename: keep the exported C entry points working — either keep the old names as the exported symbols with new internal aliases, or rename and provide compatibility macros in httpcgi.h. Coordinate with mvsMF if it references any of these.
• Struct field layout/offsets stay put (HTTPCGI is opaque to CGI modules but still ABI-adjacent) — this is a rename, not a re-layout.
• Mechanical but wide; best done as its own PR so the diff is reviewable as a pure rename.

---

Task 2 — Retire the global LOGIN bitmask

What. Remove the coarse global login policy once per-route AUTH= is the only mechanism in use:

• httpd->login field and the HTTPD_LOGIN_ALL/CGI/GET/HEAD/POST bits (include/httpd.h).
• parse_login() and the LOGIN= Parmlib key (src/httpprm.c).
• The legacy branch in needs_login() and the HTTP_AUTH_DEFAULT fallback in auth_gate() (src/httppc.c) that consult the bitmask when a route has no explicit AUTH=.

Why. #98 kept LOGIN as the default for routes without an explicit AUTH=, precisely so existing Parmlib members keep working. Once every route declares its own AUTH=, the bitmask is dead weight: two overlapping auth policies (global bitmask + per-route mode) is exactly the kind of divergence the redesign set out to remove, and HTTP_AUTH_DEFAULT only exists to bridge it.

When. Only once no deployment relies on LOGIN= any more — i.e. after the sample Parmlib, mvsMF, and any downstream configs have migrated to per-route AUTH=. This is a backward-compatibility break, so it needs a deprecation window (warn on LOGIN= for a release, then remove). Later than Task 1.

Scope / caveats.

• Decide the default for a route with no AUTH= after removal (likely HTTP_AUTH_NONE, i.e. public unless a route opts in) and document it.
• Update samplib/httpprm0 and docs/configuration.md (drop LOGIN, show per-route AUTH= as the only mechanism).

---

Done when

• Task 1: HTTPCGI renamed to a route type across httpd; HTTPX offsets/asm() names unchanged; CGI-facing entry points still resolve; builds clean under -Wall -Werror; all modules link.
• Task 2: LOGIN= deprecated then removed; needs_login() legacy branch and HTTP_AUTH_DEFAULT gone; default-auth behavior documented; sample Parmlib + docs updated.

Follows #98 · epic #100 (httpd side complete).