fix: auth reconnection loop, duplicate login listeners, modal double-disable

- websocket: clear tokens on refresh failure to prevent infinite 401 loop
- api: write vw:user to sessionStorage on refresh for consistency with WS
- api: remove vw:user from sessionStorage in clearAuthTokens
- login: guard listener setup with flags to prevent duplicate attachment
- modal: skip inline button disable when handler uses processing state
- users: remove unused requestUpdate import

webui/static/pages/users.js

@@ -5,7 +5,7 @@
  * Requires auth: rw permission.
  */
 
-import { h, definePage, reactive, requestUpdate } from '/static/hoover/index.js?v=11';
+import { h, definePage, reactive } from '/static/hoover/index.js?v=11';
 import { html, PageHeader, Table, Badge, ConfirmDelete, Empty, Card, openModal, closeModal, formModal, apiFetch, toast, esc } from '/static/hoover/index.js?v=11';
 
 const SUBSYSTEMS = [