security: harden builtin admin pwd logging and fix auth token persistence

- Truncate admin password in logs; write full password to data/auth.log (0o600)
- Persist access token in sessionStorage so it survives page reloads
- Simplify tryRefreshToken to use GSAP-style promise deduplication
- Remove spurious POST redirect on 401 during token refresh
- Guard passkey button reference in login finally block

lib/db.py

@@ -308,9 +308,19 @@ def _seed_builtin_admin(db: Database) -> None:
 
     logger.warning(
         "Builtin admin user created. THIS IS A FALLBACK — bootstrap_auth.py "
-        "should have run during install. Admin password: %s",
-        random_password,
+        "should have run during install. Admin password: %s... (check data/auth.log)",
+        random_password[:6],
     )
+    auth_log = Path("/var/log/vacuum-wall/auth.log")
+    try:
+        auth_log.write_text(
+            f"Builtin admin password: {random_password}\n", encoding="utf-8"
+        )
+        import os as _os
+
+        _os.chmod(str(auth_log), 0o600)
+    except OSError:
+        pass
 
 
 def reset_db_for_test() -> None: