auth: fix WS session_id extraction and track WebAuthn success/failure

Browsers cannot send custom X-Session-Id header on WebSocket connections,
so decode the token payload to extract session_id. Add WebAuthn
success/failure recording to support rate limiter counter resets.

daemon/server.py

@@ -373,7 +373,7 @@ async def _handle_ws(request: web.Request) -> web.Response:
     1. WebSocket subprotocol header (Sec-WebSocket-Protocol: "Bearer <token>")
     2. X-Auth-Token header (nginx-injected)
     """
-    from lib.auth import validate_token
+    from lib.auth import decode_token, validate_token
 
     token_param = None
 
@@ -392,11 +392,16 @@ async def _handle_ws(request: web.Request) -> web.Response:
             {"ok": False, "error": "authentication required"}, status=401
         )
 
-    session_header = request.headers.get("X-Session-Id")
-    if not session_header:
+    # Decode token to extract session_id from payload (browsers can't send
+    # X-Session-Id header on WebSocket connections, only subprotocols)
+    raw_payload = decode_token(token_param)
+    if raw_payload is None:
         return web.json_response({"ok": False, "error": "unauthorized"}, status=401)
+
     payload = validate_token(
-        token_param, token_type="access", session_id=session_header
+        token_param,
+        token_type="access",
+        session_id=raw_payload.get("session_id"),
     )
     if payload is None:
         return web.json_response({"ok": False, "error": "unauthorized"}, status=401)