fix: harden auth with refresh token session binding, logging, and router state

- Add session_id to refresh tokens and enforce it during validation,
  preventing stolen refresh tokens from being usable without the
  originating browser session
- Set router.isAuthenticated via auth:login event after successful
  login (previously only set at page load)
- Add console.warn logging to WS message parse/handler errors
- Improve _refreshPromise error handling in token refresh flow
- Document rate limiter in-memory limitation and CSP connect-src
  same-origin requirement
- Add 3 tests for session-bound refresh token validation

webui/static/hoover/components/auth.js

@@ -130,6 +130,13 @@ export function handleLoginSuccess(data, redirectPath = '/dashboard') {
         }
         scheduleTokenRefresh();
     }
+    // Notify app.js that auth is established (used to set router.isAuthenticated)
+    window.dispatchEvent(new CustomEvent('auth:login', {
+        detail: {
+            permissions: sessionStorage.getItem('vw:permissions') ?
+                JSON.parse(sessionStorage.getItem('vw:permissions')) : {},
+        },
+    }));
     window.location.hash = redirectPath;
 }