auth: fix WS session_id extraction and track WebAuthn success/failure

Browsers cannot send custom X-Session-Id header on WebSocket connections,
so decode the token payload to extract session_id. Add WebAuthn
success/failure recording to support rate limiter counter resets.

daemon/handlers/auth.py

@@ -39,6 +39,8 @@ from lib.auth import (
     get_access_ttl,
     record_login_failure,
     record_login_success,
+    record_webauthn_failure,
+    record_webauthn_success,
     validate_token,
 )
 from lib.auth_users import (
@@ -519,13 +521,19 @@ def webauthn_authenticate_finish(_request: Any, body: Any) -> dict[str, Any]:
     if not check_webauthn_rate(username, client_ip):
         raise ValueError("Too many WebAuthn attempts. Please try again later.")
 
-    verify_authentication(
-        username,
-        assertion_response,
-        auth_options,
-        origin=origin,
-        rp_id=rp_id,
-    )
+    try:
+        verify_authentication(
+            username,
+            assertion_response,
+            auth_options,
+            origin=origin,
+            rp_id=rp_id,
+        )
+    except ValueError:
+        record_webauthn_failure(username, client_ip)
+        raise
+
+    record_webauthn_success(username, client_ip)
 
     user = get_user(username)
     if user is None: