refactor: switch auth data from localStorage to sessionStorage

Aligns user and permissions storage with the existing sessionStorage-based
token model. Eliminates the dual-write pattern and stale cross-session data.

webui/static/app.js

@@ -33,7 +33,7 @@ const _NavBase = [
 
 function getNav() {
     const nav = [..._NavBase];
-    const perms = JSON.parse(localStorage.getItem('vw:permissions') || 'null');
+    const perms = JSON.parse(sessionStorage.getItem('vw:permissions') || 'null');
     if (perms && perms.auth === 'rw') {
         nav.push({ path: '/users', label: 'Users' });
     }