https://gitlab.synchro.net/main/sbbs/-/commit/3cd05185ae71b03a3971332f
Modified Files:
ctrl/sbbs.ini docs/v322_new.md exec/load/sbbsini.js src/sbbs3/websrvr.cpp websrvr.h
Log Message:
websrvr: stop advertising TLS-PSK in the default Authentication list

The web server cannot perform TLS-PSK: the code that would register the user/password pairs with the TLS session, and the code that would read the negotiated username back off it, are both compiled out. They have been
disabled since dbbfabf1b1 (funky-27-foam, 2015-08-20), the commit that first added TLS support here, so the mechanism has never functioned.

Offering it by default meant a sysop who followed the shipped list and set Authentication = TLS-PSK for a directory got a location nobody could authenticate to, with no diagnostic explaining why.

Drop it from the default in all three places the string is spelled: the compiled-in WEB_DEFAULT_AUTH_LIST, the stock ctrl/sbbs.ini (which has carried it since 4cf1839fce, service-28-when, 2016-11-28), and the JavaScript mirror
of the default in exec/load/sbbsini.js.

Correcting the default does not reach an install whose own sbbs.ini already names TLS-PSK, since an explicit key always wins over the compiled default,
so also log a warning at web server startup when the configured list still names it.

The disabled TLS-PSK code is left in place for the day the web server gains
an additional or alternative crypto backend; this changes what is advertised, not the dormant support.

GitLab #1206

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net