fix: close refresh token session binding bypass

Add require_session parameter to validate_token to enforce session_id
matching for refresh operations. Attacker with stolen refresh token can
no longer bypass session binding by omitting session_id from request.

Also adds backend guard against deleting builtin admin user (was only
blocked at Flask blueprint layer), and removes unused _ALL_RW variable.

lib/auth_users.py

@@ -284,8 +284,11 @@ def delete_user(username: str) -> bool:
         True if the user was deleted.
 
     Raises:
-        ValueError: If the user does not exist.
+        ValueError: If the user does not exist or is the builtin admin.
     """
+    if username == BUILTIN_ADMIN_USERNAME:
+        raise ValueError("Cannot delete builtin admin user")
+
     user = find_user(username)
     if user is None:
         raise ValueError(f"User {username!r} not found")