feat(kernel): add passive TCP server abstractions

[MikiEEE]

Summary

• add capability-first passive TCP server operations to the kernel
• keep passive address records and socket handles opaque to consumers
• implement Unix bind, listen, accept, reuse-address, and address inspection
• add conservative MicroPython capability and resolver fallbacks without guessed constants
• make unsupported base operations explicit
• migrate the web demo to kernel-owned listener operations with exact rollback

Review

Independent adversarial review found a medium listener-lifecycle issue that could leak on startup output failure or mask a primary server exception during close. The ownership boundary and best-effort teardown were fixed, regression tests were added, and targeted re-review approved. A separate critic pass found no remaining blocking issues.

Validation

• 137 unit tests passed; two loopback tests skip under the filesystem sandbox
• the loopback echo and nonblocking accept tests passed separately with network access
• package, test, and demo compilation passed
• direct platform-socket operations are absent from the migrated listener path
• git diff --check passed
• local Pyright, coverage, and PEP 517 build tooling were unavailable; GitHub CI is authoritative for those gates

Residual risk

Injected MicroPython modules cannot replace validation on representative device ports.

Closes #36