fix: dual-key rate limiting for auth + websocket reconnect guard

- Pass client IP (X-Real-IP header) through Flask to daemon for both
  password login and WebAuthn authenticate-finish endpoints
- Rate limiter now checks both IP and username buckets: IP layer catches
  enumeration/brute-force attacks across multiple usernames; username
  layer protects against single-account targeting from multiple IPs
- Add _wsRefreshing flag to prevent double-scheduling reconnect when
  onclose fires during token refresh; simplify async IIFE to .then()/.catch()
- Reset _wsRefreshing on websocket onopen for safety

webui/api/auth.py

@@ -49,6 +49,7 @@ def login():
     """
     try:
         body = request.get_json(silent=True) or {}
+        body["client_ip"] = request.headers.get("X-Real-IP") or request.remote_addr
         return _ok(post(POST_AUTH_LOGIN, body))
     except Exception as exc:
         logger.error("Login failed: %s", exc)
@@ -289,6 +290,7 @@ def webauthn_authenticate_finish():
     """
     try:
         body = request.get_json(silent=True) or {}
+        body["client_ip"] = request.headers.get("X-Real-IP") or request.remote_addr
         return _ok(post(POST_AUTH_WEBAUTHN_AUTHENTICATE_FINISH, body))
     except Exception as exc:
         logger.error("WebAuthn authenticate finish failed: %s", exc)