fix: harden auth with refresh token session binding, logging, and router state

- Add session_id to refresh tokens and enforce it during validation,
  preventing stolen refresh tokens from being usable without the
  originating browser session
- Set router.isAuthenticated via auth:login event after successful
  login (previously only set at page load)
- Add console.warn logging to WS message parse/handler errors
- Improve _refreshPromise error handling in token refresh flow
- Document rate limiter in-memory limitation and CSP connect-src
  same-origin requirement
- Add 3 tests for session-bound refresh token validation

tests/test_auth.py

@@ -811,6 +811,30 @@ class TestTokenValidationEdgeCases:
         payload = validate_token(token, "refresh")
         assert payload is None
 
+    def test_refresh_token_with_session_id_validates(self) -> None:
+        """Refresh token with session_id validates when matching session_id provided."""
+        create_user("sessuser", "password123")
+        token = generate_refresh_token("sessuser", session_id="mysession")
+        payload = validate_token(token, "refresh", session_id="mysession")
+        assert payload is not None
+        assert payload["sub"] == "sessuser"
+        assert payload["session_id"] == "mysession"
+
+    def test_refresh_token_with_wrong_session_id_rejected(self) -> None:
+        """Refresh token with session_id is rejected when wrong session_id provided."""
+        create_user("sessuser", "password123")
+        token = generate_refresh_token("sessuser", session_id="mysession")
+        payload = validate_token(token, "refresh", session_id="wrongsession")
+        assert payload is None
+
+    def test_refresh_token_generate_tokens_includes_session_id(self) -> None:
+        """generate_tokens produces refresh token with session_id."""
+        create_user("tokuser", "password123")
+        tokens = generate_tokens("tokuser", {"firewall": "rw"})
+        refresh = decode_token(tokens["refresh_token"])
+        assert refresh is not None
+        assert refresh["session_id"] == tokens["session_id"]
+
 
 # ═══════════════════════════════════════════════════════════════════════════
 # Multi-user tests (Phase 3)