fix: dhcp auto-sync UI refresh, users.js null guard, and login toast escaping

webui/static/pages/login.js

@@ -16,6 +16,7 @@ import {
     handleLoginSuccess,
     webauthnSupported,
     startAuthentication,
+    esc,
 } from '/static/hoover/index.js';
 
 function LoginPage() {
@@ -89,7 +90,7 @@ async function doPasswordLogin() {
 
     if (res.ok) {
         handleLoginSuccess(res.data);
-        toast('Welcome, ' + username, 'success');
+        toast('Welcome, ' + esc(username), 'success');
     } else {
         errEl.textContent = res.error || 'Login failed';
     }
@@ -173,7 +174,7 @@ const passkeyClickHandler = async () => {
 
         if (finishRes.ok) {
             handleLoginSuccess(finishRes.data);
-            toast('Welcome, ' + username, 'success');
+            toast('Welcome, ' + esc(username), 'success');
         } else {
             errEl.textContent = finishRes.error || 'Passkey authentication failed';
         }