fix: harden retry JSON parsing and exempt personal auth routes

webui/static/hoover/api.js
  Guard retryRes.json() with .catch(() => null) so non-JSON
  responses (e.g. nginx 502/503) don't throw and lose the
  actual status code. Falls back to 'HTTP <status>' error string.

lib/db_sqlite.py
  Replace unsafe sql.split(';') loop with conn.executescript()
  which properly handles semicolons inside string literals.

webui/server.py
  Add _AUTH_PERSONAL set and _is_personal_auth() so personal
  auth operations (session, password, logout, webauthn creds)
  skip subsystem permission checks. Users with only firewall:read
  can now manage their own credentials without needing auth:rw.

lib/db_sqlite.py

@@ -168,7 +168,4 @@ class SQLiteBackend(Database):
 
     def _execute_direct(self, sql: str) -> None:
         """Execute raw SQL without prepared statements (for DDL)."""
-        for line in sql.split(";"):
-            line = line.strip()
-            if line:
-                self.conn.execute(line)
+        self.conn.executescript(sql)