fix: clean up lazy import, dead var, whitespace; document WS session caveat

- Move get_all_credential_counts import to top-level in daemon/handlers/auth.py
- Remove unused PROJECT_DIR in scripts/bootstrap_auth.py
- Fix leading space in api.js tryRefreshToken function
- Document WebSocket session binding limitation in docs/security.md

scripts/bootstrap_auth.py

@@ -17,7 +17,6 @@ import sys
 from pathlib import Path
 
 # Ensure project lib is importable
-PROJECT_DIR = Path(".")
 
 
 def main() -> None: