fix: prevent data loss in update_permissions and token_refresh

- update_permissions: swap to upsert-first-then-delete-stale so a
  failed upsert mid-loop rolls back cleanly, leaving the user's
  permissions intact. Adds Q_DELETE_PERMISSION_SUBSYSTEM for
  targeted removal.

- auth_refresh: generate and persist the new refresh token before
  blacklisting/clearing the old one, so a failure in generate_tokens
  doesn't leave the user locked out with no valid refresh token.

lib/db_sqlite.py

@@ -13,6 +13,7 @@ from typing import Any, ClassVar
 
 from lib.db import (
     Q_DELETE_EXPIRED_BLACKLIST,
+    Q_DELETE_PERMISSION_SUBSYSTEM,
     Q_DELETE_PERMISSIONS,
     Q_DELETE_REFRESH_TOKEN,
     Q_DELETE_USER,
@@ -88,6 +89,9 @@ class SQLiteBackend(Database):
             "SELECT subsystem, level FROM permissions WHERE username = ?"
         ),
         Q_DELETE_PERMISSIONS: ("DELETE FROM permissions WHERE username = ?"),
+        Q_DELETE_PERMISSION_SUBSYSTEM: (
+            "DELETE FROM permissions WHERE username = ? AND subsystem = ?"
+        ),
         # Token blacklist
         Q_INSERT_BLACKLIST: (
             "INSERT OR IGNORE INTO token_blacklist (jti, token_type, expires) VALUES (?, ?, ?)"