fix: prevent data loss in update_permissions and token_refresh

- update_permissions: swap to upsert-first-then-delete-stale so a
  failed upsert mid-loop rolls back cleanly, leaving the user's
  permissions intact. Adds Q_DELETE_PERMISSION_SUBSYSTEM for
  targeted removal.

- auth_refresh: generate and persist the new refresh token before
  blacklisting/clearing the old one, so a failure in generate_tokens
  doesn't leave the user locked out with no valid refresh token.

daemon/handlers/auth.py

@@ -184,13 +184,17 @@ def auth_refresh(_request: Any, body: Any) -> dict[str, Any]:
     if user is None:
         raise ValueError("User not found")
 
+    # Persist new tokens first, then invalidate the old ones.
+    # This prevents data loss if generate_tokens fails mid-way:
+    # the old refresh token remains valid and the user is not locked out.
+    permissions = user["permissions"]
+    tokens = generate_tokens(username, permissions)
+
     jti = payload.get("jti")
     if jti:
         blacklist_token(jti, token_type="refresh")
     if username:
         _clear_refresh_token_after_rotation(username)
-    permissions = user["permissions"]
-    tokens = generate_tokens(username, permissions)
 
     return {
         "tokens": tokens,