refactor: switch auth data from localStorage to sessionStorage

Aligns user and permissions storage with the existing sessionStorage-based
token model. Eliminates the dual-write pattern and stale cross-session data.

webui/static/hoover/api.js

@@ -47,7 +47,7 @@ function clearAuthTokens() {
     sessionStorage.removeItem('vw:access_ttl');
     sessionStorage.removeItem('vw:session_id');
     sessionStorage.removeItem('vw:user');
-    localStorage.removeItem('vw:user');
+    sessionStorage.removeItem('vw:user');
     if (typeof window.__authRefreshTimer__ !== 'undefined') {
         clearTimeout(window.__authRefreshTimer__);
         window.__authRefreshTimer__ = undefined;
@@ -112,7 +112,6 @@ async function tryRefreshToken() {
             }
             if (json.data.user) {
                 sessionStorage.setItem('vw:user', JSON.stringify(json.data.user));
-                localStorage.setItem('vw:user', JSON.stringify(json.data.user));
             }
             return true;
         } catch {