fix: invalidate tokens on permission change (medium), optimize create_user query, fix ws reconnect race

- update_permissions now calls blacklist_active_refresh_token and
  rotate_user_secret to immediately invalidate stale tokens
- create_user uses returned id from tx.run_one instead of redundant SELECT
- websocket reconnect explicitly closes old connection after token refresh
  to prevent onclose handler race condition

webui/static/hoover/websocket.js

@@ -59,12 +59,14 @@ function _wsConnect() {
 
         if (_wsFailCount >= 3 && !_wsRefreshing) {
             _wsRefreshing = true;
+            const oldConn = _wsConn;
             tryRefreshToken().then(ok => {
                 _wsRefreshing = false;
                 if (ok) {
                     _wsFailCount = 0;
                     _wsReconnectMs = 0;
                     _wsConn = null;
+                    if (oldConn) oldConn.close();
                     setTimeout(_wsConnect, 100);
                 } else {
                     redirectLogin();