ui: per-container #comp lifecycle, exp-claim auth refresh TTL

- hoover: #comp registry + expanded-content cache now per render
  container; committing one root no longer unmounts/remounts
  components owned by another root (infinite load loop on pages
  whose load() re-mutates reactive state)
- auth_model: refresh timer scheduled from the token's remaining
  exp claim (unverified decode, mirrors lib/auth.py); falls back to
  the configured TTL for non-JWT/malformed/already-expired tokens
- docs: hoover.md documents both behaviors
- tests: exp-claim TTL cases in test-auth-model.js; new
  test-render-lifecycle.js regression suite

webui/static/hoover/component.js

@@ -17,7 +17,6 @@
 
 import { reactive } from './reactivity.js';
 import { h } from './vdom.js';
-import { _compExpandedCache } from './render.js';
 
 /** Registry of mounted components: key → { state } */
 const _mounted = new Map();
@@ -90,7 +89,7 @@ export function mountComponent(key, renderer) {
  * Unmount a page component. Called by the render engine when a #comp vnode
  * is removed from the tree.
  */
-export function unmountComponent(key, renderer) {
+export function unmountComponent(key, renderer, compCache) {
     const entry = _mounted.get(key);
     if (!entry) return;
 
@@ -103,7 +102,7 @@ export function unmountComponent(key, renderer) {
         try { pd.onUnmount(entry.state); } catch (_) {}
     }
 
-    _compExpandedCache.delete(key);
+    if (compCache) compCache.delete(key);
     _mounted.delete(key);
 }