security: harden builtin admin pwd logging and fix auth token persistence

- Truncate admin password in logs; write full password to data/auth.log (0o600)
- Persist access token in sessionStorage so it survives page reloads
- Simplify tryRefreshToken to use GSAP-style promise deduplication
- Remove spurious POST redirect on 401 during token refresh
- Guard passkey button reference in login finally block

webui/static/pages/login.js

@@ -185,8 +185,10 @@ const passkeyClickHandler = async () => {
             errEl.textContent = err.message || 'Passkey authentication failed';
         }
     } finally {
-        btn.disabled = false;
-        btn.textContent = 'Sign in with passkey';
+        if (btn) {
+            btn.disabled = false;
+            btn.textContent = 'Sign in with passkey';
+        }
     }
 };