fix: address auth subsystem issues from ws-debug review

- lib/auth: make RateLimiter.is_allowed read-only (no dict mutation on read)
- daemon/server: add periodic blacklist_expired cleanup to poll loop (60s interval)
- daemon/server: negotiate only matched Bearer subprotocol on WebSocket connect
- webui/server: rewrite _is_personal_auth with path-prefix matching, cover WebAuthn register routes
- daemon/handlers/auth: eliminate redundant get_user call in auth_update_user

lib/auth.py

@@ -379,11 +379,8 @@ class RateLimiter:
         now = time.time()
         cutoff = now - self.window
         timestamps = self.failures.get(key, [])
-
-        # Clean old entries
-        self.failures[key] = [t for t in timestamps if t > cutoff]
-
-        return len(self.failures[key]) < self.max_attempts
+        clean = [t for t in timestamps if t > cutoff]
+        return len(clean) < self.max_attempts
 
     def record_failure(self, key: str) -> None:
         """Record a failed attempt for *key*."""