fix: WS reconnection deadlock, remove redundant try/except, fix docs

- websocket.js: schedule reconnect backoff when token refresh fails,
  otherwise WebSocket stays dead after 3+ disconnects with failed refresh
- daemon/handlers/auth.py: remove two redundant try/except ValueError: raise
  blocks in webauthn register/authenticate finish handlers
- docs/api.md: mark permissions as optional in Create User endpoint

daemon/handlers/auth.py

@@ -409,13 +409,10 @@ def webauthn_register_finish(_request: Any, body: Any) -> dict[str, Any]:
             "username, credential_response, and registration_options are required"
         )
 
-    try:
     cred = verify_registration(
         username, credential_response, registration_options, credential_name
     )
     return {"ok": True, "credential": cred}
-    except ValueError:
-        raise
 
 
 @registry.register(POST_AUTH_WEBAUTHN_AUTHENTICATE_BEGIN)
@@ -458,10 +455,7 @@ def webauthn_authenticate_finish(_request: Any, body: Any) -> dict[str, Any]:
     if not check_webauthn_rate(username, client_ip):
         raise ValueError("Too many WebAuthn attempts. Please try again later.")
 
-    try:
     verify_authentication(username, assertion_response, auth_options)
-    except ValueError:
-        raise
 
     user = get_user(username)
     if user is None:

docs/api.md

@@ -204,7 +204,7 @@ Create a new user with password and per-subsystem permissions.
 |---|---|---|---|
 | `username` | `string` | Yes | Username |
 | `password` | `string` | Yes | Plain-text password |
-| `permissions` | `object` | Yes | Per-subsystem permissions (`{ subsystem: "read" \| "rw" }`) |
+| `permissions` | `object` | No | Per-subsystem permissions (`{ subsystem: "read" \| "rw" }`) |
 
 **Response:** `data` is `null` on success.
 

webui/static/hoover/websocket.js

@@ -62,6 +62,8 @@ function _wsConnect() {
                 setTimeout(_wsConnect, 100);
             }).catch(() => {
                 _wsRefreshing = false;
+                _wsReconnectMs = Math.min(_wsReconnectMs * 2 + 1000, 15000);
+                setTimeout(_wsConnect, _wsReconnectMs);
             });
             return;
         }