fix: harden retry JSON parsing and exempt personal auth routes

webui/static/hoover/api.js
  Guard retryRes.json() with .catch(() => null) so non-JSON
  responses (e.g. nginx 502/503) don't throw and lose the
  actual status code. Falls back to 'HTTP <status>' error string.

lib/db_sqlite.py
  Replace unsafe sql.split(';') loop with conn.executescript()
  which properly handles semicolons inside string literals.

webui/server.py
  Add _AUTH_PERSONAL set and _is_personal_auth() so personal
  auth operations (session, password, logout, webauthn creds)
  skip subsystem permission checks. Users with only firewall:read
  can now manage their own credentials without needing auth:rw.

webui/static/hoover/api.js

@@ -176,17 +176,16 @@ export async function apiFetch(url, options = {}) {
                     headers['X-Session-Id'] = refreshedStored.session_id;
                 }
                 const retryRes = await fetch(url, { method, headers, body: options.body, credentials: 'same-origin', ...opts });
-                const json = await retryRes.json();
                 if (retryRes.ok) {
-                    return { ok: json.ok, data: json.ok ? json.data : json, error: null, status: retryRes.status };
+                    const json = await retryRes.json().catch(() => null);
+                    return { ok: json?.ok ?? true, data: json ? (json.ok ? json.data : json) : null, error: null, status: retryRes.status };
                 }
                 if (retryRes.status === 401) {
                     redirectLogin();
                     return { ok: false, data: null, error: 'Session expired', status: 401 };
                 }
-                if (!retryRes.ok) {
-                    return { ok: false, data: null, error: json.error || `HTTP ${retryRes.status}`, status: retryRes.status };
-                }
+                const json = await retryRes.json().catch(() => null);
+                return { ok: false, data: null, error: json?.error || `HTTP ${retryRes.status}`, status: retryRes.status };
             }
             redirectLogin();
             return { ok: false, data: null, error: 'Session expired', status: 401 };