fix: auth reconnection loop, duplicate login listeners, modal double-disable

- websocket: clear tokens on refresh failure to prevent infinite 401 loop
- api: write vw:user to sessionStorage on refresh for consistency with WS
- api: remove vw:user from sessionStorage in clearAuthTokens
- login: guard listener setup with flags to prevent duplicate attachment
- modal: skip inline button disable when handler uses processing state
- users: remove unused requestUpdate import

webui/static/pages/login.js

@@ -56,7 +56,13 @@ function LoginPage() {
     `;
 }
 
+let _loginFormBound = false;
+let _passkeyBound = false;
+
 function handleLogin() {
+    if (_loginFormBound) return;
+    _loginFormBound = true;
+
     const form = document.getElementById('loginForm');
     if (!form) return;
 
@@ -90,6 +96,9 @@ async function doPasswordLogin() {
 }
 
 function setupPasskeyButton() {
+    if (_passkeyBound) return;
+    _passkeyBound = true;
+
     const passkeyBtn = document.getElementById('passkeyBtn');
     if (!passkeyBtn) return;
 

webui/static/pages/users.js

@@ -5,7 +5,7 @@
  * Requires auth: rw permission.
  */
 
-import { h, definePage, reactive, requestUpdate } from '/static/hoover/index.js?v=11';
+import { h, definePage, reactive } from '/static/hoover/index.js?v=11';
 import { html, PageHeader, Table, Badge, ConfirmDelete, Empty, Card, openModal, closeModal, formModal, apiFetch, toast, esc } from '/static/hoover/index.js?v=11';
 
 const SUBSYSTEMS = [