ubus: honour "X-Ubus-No-Touch: 1" HTTP header on /ubus/

[micpf]

Add optional client-side signalling that a /ubus/ request is background activity that must not refresh the rpcd session idle timer, so that the documented sessiontime option in /etc/config/rpcd finally expires an idle LuCI login.

How it works

• Parse X-Ubus-No-Touch: 1 from the HTTP request headers alongside the existing Authorization header.
• Forward the hint as the new optional notouch boolean argument to rpcd's session/access RPC, in two paths:
  • uhttpd's internal ACL check (uh_ubus_allowed), which runs before every downstream RPC dispatched over /ubus/.
  • A direct client-initiated session/access call — LuCI probes access-group ACLs from view code, and those calls must be marked too.
• Only session/access is intercepted; every other object/method pair passes through unchanged. Header absent → zero behavioural change.

Companion patches

• rpcd side: session: make rpc_session_get() a pure lookup and add "notouch" to session/access rpcd#39 (session/access grows the notouch policy field; rpc_session_get becomes a pure lookup).
• LuCI side: luci-base: mark background poll XHRs with X-Ubus-No-Touch header luci#8916 (Poll callbacks emit the X-Ubus-No-Touch: 1 header on any XHR they issue).

Design note (header vs. query parameter)

An earlier revision of this PR used a ?_luci_bg=1 query parameter and injected notouch=1 at uh_ubus_send_request unconditionally. The header form is cleaner and per @jow-'s review has been adopted. The switch also let us drop the wildcard notouch injection and scope it to session/access — everything else is now a straight pass-through.

Verified end-to-end on a t1023 (25.12) target with option sessiontime '30': a LuCI tab left focused and idle now correctly reaches expires:0 inside the timeout and shows the "Session expired" modal on the next Poll tick.

[jow-]

I don't like the design, it's essentially hacking a LuCI specifc special case into the ubus HTTP gateway. My gut feeling is that this either should be an HTTP header (no query string, no ubus method call arg) or maybe even a property of the ubus ACL, shifting control entirely to the rpcd side and avoiding the need to expose any of that to uhttpd or LuCI while also paving the way for other potential flags in the future.

[micpf]

Thanks for the review, @jow- — you're right that the HTTP header is the cleaner transport and I've reworked the PR accordingly. Force-pushed as 64d1c48.

A quick note on why the original revision used a query parameter and a wildcard notouch injection, in case it's useful for future context:

• Query parameter over header: rationale was batch-safety and log-visibility. Some LuCI code paths batch multiple RPCs into a single /ubus/ POST; a per-batch header can only carry one hint for the whole batch, whereas a per-URL parameter makes the "background" nature of the batch explicit at every layer that later inspects request URLs (access logs, debug proxies, session dumps). That trade-off didn't outweigh the cost of grepping URLs in ubus.c though — the header route reuses the existing Authorization header parsing infrastructure, which is a much smaller diff.
• Injecting notouch at uh_ubus_send_request unconditionally: originally the rpcd change (rpcd#39) still had rpc_session_get() touching, so we had to cover downstream RPCs too. Once rpcd was cleaned up so only the session/access method touches, injection could be scoped tightly. The revised patch only injects notouch=1 when uhttpd itself invokes session/access (either the internal uh_ubus_allowed probe or a client-initiated session/access RPC). All other methods pass through untouched.

End-to-end tested on a t1023 (25.12) target with option sessiontime '30': idle LuCI tab now correctly hits expires:0 inside the timeout and the "Session expired" modal fires on the next Poll tick.