fix: harden auth with refresh token session binding, logging, and router state

- Add session_id to refresh tokens and enforce it during validation,
  preventing stolen refresh tokens from being usable without the
  originating browser session
- Set router.isAuthenticated via auth:login event after successful
  login (previously only set at page load)
- Add console.warn logging to WS message parse/handler errors
- Improve _refreshPromise error handling in token refresh flow
- Document rate limiter in-memory limitation and CSP connect-src
  same-origin requirement
- Add 3 tests for session-bound refresh token validation

webui/static/hoover/websocket.js

@@ -91,7 +91,9 @@ function _wsConnect() {
         try {
             const msg = typeof ev.data === 'string' ? JSON.parse(ev.data) : ev.data;
             handleMessage(msg);
-        } catch (_) {}
+        } catch (err) {
+            console.warn('[WS] Failed to parse message:', err);
+        }
     };
 }
 
@@ -124,7 +126,7 @@ function handleMessage(msg) {
     for (const h of _directHandlers) {
         if (h.unsubscribed) continue;
         if (topics.some(t => h.topics.includes(t) || h.topics.includes('*'))) {
-            try { h.handler(msg); } catch (_) {}
+            try { h.handler(msg); } catch (err) { console.warn('[WS] Handler error:', err); }
         }
     }
 }