fix: dhcp auto-sync UI refresh, users.js null guard, and login toast escaping

webui/static/pages/dhcp.js

@@ -213,6 +213,7 @@ export default definePage({
                             let msg = 'dnsmasq applied';
                             if (synced && synced.length) {
                                 msg += ' (auto-synced: ' + synced.join(', ') + ')';
+                                synced.forEach(s => modelFetch(s));
                             }
                             toast(msg, 'success');
                             modelFetch('dnsmasq');

webui/static/pages/login.js

@@ -16,6 +16,7 @@ import {
     handleLoginSuccess,
     webauthnSupported,
     startAuthentication,
+    esc,
 } from '/static/hoover/index.js';
 
 function LoginPage() {
@@ -89,7 +90,7 @@ async function doPasswordLogin() {
 
     if (res.ok) {
         handleLoginSuccess(res.data);
-        toast('Welcome, ' + username, 'success');
+        toast('Welcome, ' + esc(username), 'success');
     } else {
         errEl.textContent = res.error || 'Login failed';
     }
@@ -173,7 +174,7 @@ const passkeyClickHandler = async () => {
 
         if (finishRes.ok) {
             handleLoginSuccess(finishRes.data);
-            toast('Welcome, ' + username, 'success');
+            toast('Welcome, ' + esc(username), 'success');
         } else {
             errEl.textContent = finishRes.error || 'Passkey authentication failed';
         }

webui/static/pages/users.js

@@ -5,8 +5,7 @@
  * Requires auth: rw permission.
  */
 
-import { h, definePage, reactive } from '/static/hoover/index.js';
+import { h, definePage, reactive, html, PageHeader, Table, Badge, ConfirmDelete, openModal, closeModal, formModal, apiFetch, toast, esc } from '/static/hoover/index.js';
-import { html, PageHeader, Table, Badge, ConfirmDelete, Empty, Card, openModal, closeModal, formModal, apiFetch, toast, esc } from '/static/hoover/index.js';
 
 const BUILTIN_ADMIN = 'admin';
 
@@ -69,7 +68,7 @@ async function loadUsers(abortController) {
 }
 
 function permissionLevel(perms, subsystem) {
-    return perms[subsystem] || '—';
+    return perms?.[subsystem] || '—';
 }
 
 function openCreateUserModal() {