Implement native login and session initialization (#56)

README.md

@@ -294,6 +294,15 @@ retry handling while preserving permanent 401/403/404/410 failures. Capability
 URLs and tokens are absent from errors and diagnostics. Ownership, limits,
 injection, and offline fake-server coverage are documented in
 [`docs/caps-http.md`](docs/caps-http.md).
+Login is implemented against that transport with the C# password-hashing and
+token rules, viewer/channel/platform fields, start-location normalization,
+bounded redirects, cancellation, and typed status transitions. Native response
+parsing populates session, simulator, inventory, buddy, account-benefit, and
+service fields before the initial UDP circuit and seed capability are installed.
+Credentials and session/capability tokens are redacted from diagnostics, and
+offline fake login/simulator tests cover success, rejection, redirect, timeout,
+and cancellation cleanup. The login contract is documented with the network
+lifecycle in [`docs/network-manager.md`](docs/network-manager.md).
 Seed-cap discovery and `EventQueueGet` are native Rust too: the full reference
 capability list is posted as LLSD/XML, accepted URIs are rate-categorized, and
 bounded long polls preserve ack IDs, reconnect retries, shutdown `done`, and