fix: address auth subsystem issues from ws-debug review

- lib/auth: make RateLimiter.is_allowed read-only (no dict mutation on read)
- daemon/server: add periodic blacklist_expired cleanup to poll loop (60s interval)
- daemon/server: negotiate only matched Bearer subprotocol on WebSocket connect
- webui/server: rewrite _is_personal_auth with path-prefix matching, cover WebAuthn register routes
- daemon/handlers/auth: eliminate redundant get_user call in auth_update_user

daemon/handlers/auth.py

@@ -341,16 +341,15 @@ def auth_update_user(_request: Any, body: Any) -> dict[str, Any]:
     if not username:
         raise ValueError("username is required")
 
-    existing = get_user(username)
-    if existing is None:
+    user = get_user(username)
+    if user is None:
         raise NotFoundError(f"User {username!r} not found")
 
     if "permissions" in body:
         update_permissions(username, body["permissions"])
-
-    user = get_user(username)
-    if user is None:
-        raise NotFoundError(f"User {username!r} not found")
+        user = get_user(username)
+        if user is None:
+            raise NotFoundError(f"User {username!r} not found")
 
     return {
         "id": user["id"],