[bdbarnett]

On a lossy link a login that times out closed the socket without telling the board. When bytes from the board were still unread, the close became a single RST packet. If that packet is lost, the board never learns the session ended: MicroPython's webrepl has no timeout or keepalive and holds its one os.dupterm slot, so every later login got 101 then an immediate hang-up until the board was reset.

• A failed login or a close now sends a close frame, a FIN (shutdown) and drains the board's reply before close(), so nothing unread turns it into a RST and the FIN is retransmitted by TCP.
• Each login step waits at least 5 s and 30x the upgrade round trip (max 60 s); MPFTP_WEBREPL_LOGIN_TIMEOUT fixes it.
• A hang-up before the prompt raises WebReplBusyError saying the slot is held and how to free it.

Reproduced in a network namespace with RSTs dropped: before, the emulated slot stayed taken and the next login was rejected; after, the board saw EOF and freed it. Tests in cli/tests/test_webrepl.py (AbandonedLoginTests).