fix: harden auth with refresh token session binding, logging, and router state

- Add session_id to refresh tokens and enforce it during validation,
  preventing stolen refresh tokens from being usable without the
  originating browser session
- Set router.isAuthenticated via auth:login event after successful
  login (previously only set at page load)
- Add console.warn logging to WS message parse/handler errors
- Improve _refreshPromise error handling in token refresh flow
- Document rate limiter in-memory limitation and CSP connect-src
  same-origin requirement
- Add 3 tests for session-bound refresh token validation

daemon/handlers/auth.py

@@ -155,10 +155,11 @@ def auth_refresh(_request: Any, body: Any) -> dict[str, Any]:
     """Handle token refresh.
 
     Validates the refresh token, blacklists it, and issues a new access token.
+    Requires refresh_token and session_id in the request body for session binding.
 
     Args:
         _request: Unused.
-        body: Dict with ``refresh_token``.
+        body: Dict with ``refresh_token`` and ``session_id``.
 
     Returns:
         Dict with new access token, refresh token, user, and permissions.
@@ -173,7 +174,8 @@ def auth_refresh(_request: Any, body: Any) -> dict[str, Any]:
     if not refresh_token:
         raise ValueError("refresh_token is required")
 
-    payload = validate_token(refresh_token, token_type="refresh")
+    session_id = body.get("session_id")
+    payload = validate_token(refresh_token, token_type="refresh", session_id=session_id)
     if payload is None:
         raise ValueError("Invalid or expired refresh token")