fix: auth reconnection loop, duplicate login listeners, modal double-disable

- websocket: clear tokens on refresh failure to prevent infinite 401 loop
- api: write vw:user to sessionStorage on refresh for consistency with WS
- api: remove vw:user from sessionStorage in clearAuthTokens
- login: guard listener setup with flags to prevent duplicate attachment
- modal: skip inline button disable when handler uses processing state
- users: remove unused requestUpdate import

webui/static/hoover/components/modal.js

@@ -191,8 +191,15 @@ export function formModal(inner, title, fields, actions) {
         if (a.handler) {
             const origHandler = a.handler;
             btn.addEventListener('click', () => {
-                btn.disabled = true;
-                btn.innerHTML = '<span class="btn-spinner"></span>';
+                // Only inline-disable if the handler doesn't use processing
+                // state.  apiSubmit/formAction already call
+                // setModalProcessing + refreshModals which re-creates the
+                // button in processing state.  Without the guard the old
+                // button is discarded before the handler even starts.
+                if (!a.processing) {
+                    btn.disabled = true;
+                    btn.innerHTML = '<span class="btn-spinner"></span>';
+                }
                 origHandler();
             });
         }