The advertised listener should not be 0.0.0.0

This fixes a bug where pollers to the GET /session endpoint can send
messages to users who have not yet signed on, causing them to crash.

This commit adds full WebAPI support to enable Gromit (Web AIM) client connectivity:

Core Infrastructure:
- API key generation, storage, and validation system
- AMF3 encoding/decoding with Gromit-specific workarounds
- WebAPI event handling and message bridging
- Session management and authentication
- Database migrations for WebAPI-specific tables

OSCAR Integration:
- WebAPIMessageBridge for intercepting OSCAR buddy/ICBM events
- WebAPIPresenceBridge for presence broadcasting
- Cross-client compatibility with TLV filtering
- Event queue system for async communication

Features Implemented:
- Authentication and session management
- Buddy list and feed management
- Messaging (IM) support
- Presence and status updates
- Chat room support
- Preference system
- Vanity URL support
- Analytics tracking

Testing & Fixes:
- Fixed nil pointer dereferences in session management
- Resolved race conditions in buddy broadcasting
- Added comprehensive test coverage
- Made BART import script cross-platform compatible

Documentation:
- Updated configuration files with WebAPI settings
- Added migration files for database schema
- Documented smiley pack importing process

Resolved conflicts:
- .gitignore: Kept wapi-docs/ entry from WebAPI branch
- api.yml: Preserved WebAPI key management endpoints while keeping BART updates
- foodgroup/buddy.go: Kept existing BroadcastBuddyArrived method (both branches had it)
- server/http/mgmt_api.go: Kept WebAPI version with webAPIKeyManager parameter
- state/session_manager_test.go: Kept additional NotNil assertion from WebAPI branch

Webapi