auth: fix WS session_id extraction and track WebAuthn success/failure

Browsers cannot send custom X-Session-Id header on WebSocket connections,
so decode the token payload to extract session_id. Add WebAuthn
success/failure recording to support rate limiter counter resets.

lib/auth.py

@@ -453,3 +453,17 @@ def check_webauthn_rate(username: str, client_ip: str | None = None) -> bool:
     if client_ip and not _webauthn_limiter.is_allowed(client_ip):
         return False
     return _webauthn_limiter.is_allowed(username)
+
+
+def record_webauthn_failure(username: str, client_ip: str | None = None) -> None:
+    """Record a failed WebAuthn attempt."""
+    if client_ip:
+        _webauthn_limiter.record_failure(client_ip)
+    _webauthn_limiter.record_failure(username)
+
+
+def record_webauthn_success(username: str, client_ip: str | None = None) -> None:
+    """Record a successful WebAuthn attempt (resets failure counter)."""
+    if client_ip:
+        _webauthn_limiter.record_success(client_ip)
+    _webauthn_limiter.record_success(username)