fix: clean up lazy import, dead var, whitespace; document WS session caveat

- Move get_all_credential_counts import to top-level in daemon/handlers/auth.py
- Remove unused PROJECT_DIR in scripts/bootstrap_auth.py
- Fix leading space in api.js tryRefreshToken function
- Document WebSocket session binding limitation in docs/security.md

webui/static/hoover/api.js

@@ -83,7 +83,7 @@ let _refreshPromise = null;
  *
  * @returns {Promise<boolean>} ``true`` if refresh succeeded
  */
- async function tryRefreshToken() {
+async function tryRefreshToken() {
     if (!_refreshPromise) {
         _refreshPromise = (async () => {
             try {