fix: auth review fixes — token revocation, WS auth, seeding, and hardening

Refresh/logout and token robustness
- drop the post-rotation refresh_tokens row delete in auth_refresh so
  logout blacklists the current (rotated) refresh token; remove the
  dead _clear_refresh_token_after_rotation helper and clear_active_refresh_token
- reject non-object JWT payloads in _extract_unverified_sub so crafted
  Authorization headers return 401 instead of crashing with 500

SQLite user store
- make builtin-admin seeding idempotent: on a concurrent first start the
  losing seeder re-checks, finds the winner, and returns instead of
  raising IntegrityError
- per-thread sqlite connections + busy_timeout so Flask worker threads
  don't hit cross-thread ProgrammingError / SQLITE_BUSY
- add LogsDirectory + /var/log/vacuum-wall to ReadWritePaths in both
  systemd units so the fallback admin password actually lands on disk

Frontend
- skip apiFetch 401-recovery for public auth endpoints so a failed
  login no longer logs out a valid session
- add /passkeys to the nav (passkey registration was unreachable);
  remove the dead checkWebAuthnCapable export
- drop the CSP-blocked inline WS-URL script and the
  __WS_URL_PLACEHOLDER__ plumbing; the WS URL is derived from location

Daemon / WS
- parse Sec-WebSocket-Protocol manually (web.Request.get_subprotocols
  does not exist in aiohttp 3.13); X-Auth-Token is a custom-nginx
  fallback only — docstring and security docs corrected

Install / system
- bootstrap_auth.py is now idempotent: preserves existing auth config
  and syncs the admin password on re-runs (new reset_password helper)
- WebUI server block renders auth_basic off (the UI is JWT-protected)
- install.sh chown/chmod skips .git to avoid git dubious-ownership
  breakage
- tolerate unreadable /etc/wireguard during system import

Contracts / docs
- create_user returns 409 on duplicate username per docs/api.md
- correct docs/api.md response shapes, docs/security.md blacklist
  cleanup wording + one-refresh-per-user caveat, stale WS-URL
  references, and the .htpasswd description

Tests: +7 regression tests (rotation/logout revocation, crafted-token
401, concurrent seeding); placeholder-substitution tests replaced with
serve-as-is SPA root tests.

daemon/server.py

@@ -375,17 +375,24 @@ async def _handle_ws(request: web.Request) -> web.Response:
 
     Authentication: JWT access token passed via:
     1. WebSocket subprotocol header (Sec-WebSocket-Protocol: "Bearer <token>")
-    2. X-Auth-Token header (nginx-injected)
+       — the bundled client path.
+    2. X-Auth-Token header — fallback for custom nginx setups that inject it
+       (not set by the bundled nginx config).
     """
+    from aiohttp import hdrs
+
     from lib.auth import validate_token
 
     token_param = None
     matched_proto = None
 
-    # Prefer subprotocol header (client JS sends "Bearer <token>")
-    subprotocols = request.get_subprotocols()
-    for proto in subprotocols or []:
-        if proto and proto.startswith("Bearer "):
+    # Prefer subprotocol header (client JS sends "Bearer <token>").
+    # Sec-WebSocket-Protocol is a comma-separated list; parse it the same
+    # way aiohttp's own handshake does (Request has no subprotocol helper).
+    protocol_header = request.headers.get(hdrs.SEC_WEBSOCKET_PROTOCOL, "")
+    subprotocols = [p.strip() for p in protocol_header.split(",") if p.strip()]
+    for proto in subprotocols:
+        if proto.startswith("Bearer "):
             token_param = proto[7:]
             matched_proto = proto
             break