fix: auth reconnection loop, duplicate login listeners, modal double-disable

- websocket: clear tokens on refresh failure to prevent infinite 401 loop
- api: write vw:user to sessionStorage on refresh for consistency with WS
- api: remove vw:user from sessionStorage in clearAuthTokens
- login: guard listener setup with flags to prevent duplicate attachment
- modal: skip inline button disable when handler uses processing state
- users: remove unused requestUpdate import

webui/static/hoover/api.js

@@ -46,6 +46,7 @@ function clearAuthTokens() {
     sessionStorage.removeItem('vw:refresh');
     sessionStorage.removeItem('vw:access_ttl');
     sessionStorage.removeItem('vw:session_id');
+    sessionStorage.removeItem('vw:user');
     localStorage.removeItem('vw:user');
     if (typeof window.__authRefreshTimer__ !== 'undefined') {
         clearTimeout(window.__authRefreshTimer__);
@@ -102,6 +103,7 @@ async function tryRefreshToken() {
             sessionStorage.setItem('vw:session_id', tokens.session_id);
         }
         if (json.data.user) {
+            sessionStorage.setItem('vw:user', JSON.stringify(json.data.user));
             localStorage.setItem('vw:user', JSON.stringify(json.data.user));
         }
         return true;