fix: clean up lazy import, dead var, whitespace; document WS session caveat

- Move get_all_credential_counts import to top-level in daemon/handlers/auth.py
- Remove unused PROJECT_DIR in scripts/bootstrap_auth.py
- Fix leading space in api.js tryRefreshToken function
- Document WebSocket session binding limitation in docs/security.md

docs/security.md

@@ -104,6 +104,8 @@ Token theft protection:
 - Token blacklist prevents reuse after logout or password change
 - XSS mitigations: CSP headers, `X-XSS-Protection` header on management domain
 
+**WebSocket session binding limitation**: WebSocket connections skip `session_id` validation. Browsers cannot send custom headers during the WebSocket handshake — the token is passed via the `Sec-WebSocket-Protocol` subprotocol or an nginx-injected `X-Auth-Token` header. This means a stolen access token can be used to open WebSocket connections for the full 15-minute TTL without session verification. Short-lived TTL and management domain CSP headers mitigate this risk.
+
 ### WebAuthn Security
 
 WebAuthn (passkeys) provides passwordless authentication via the browser's Web Authentication API. Security properties: