fix: check tryRefreshToken result in WS reconnect, clear permissions on logout

The token refresh callback in websocket.js ignored its ok parameter, causing
an infinite reconnect loop when the server rejected the refresh attempt. On
failure, redirect to login instead of reconnecting with a cleared token.

clearAuthTokens() now also removes vw:permissions from sessionStorage to
prevent stale permissions from persisting across logout/login cycles. Also
removed duplicate vw:user removeItem call.

webui/static/hoover/api.js

@@ -47,7 +47,7 @@ function clearAuthTokens() {
     sessionStorage.removeItem('vw:access_ttl');
     sessionStorage.removeItem('vw:session_id');
     sessionStorage.removeItem('vw:user');
-    sessionStorage.removeItem('vw:user');
+    sessionStorage.removeItem('vw:permissions');
     if (typeof window.__authRefreshTimer__ !== 'undefined') {
         clearTimeout(window.__authRefreshTimer__);
         window.__authRefreshTimer__ = undefined;

webui/static/hoover/websocket.js

@@ -7,7 +7,7 @@
  */
 
 import { refreshByTopic } from './model.js?v=9';
-import { tryRefreshToken } from './api.js?v=12';
+import { tryRefreshToken, redirectLogin } from './api.js?v=12';
 
 let _wsConn = null;
 let _wsReconnectMs = 0;
@@ -56,10 +56,14 @@ function _wsConnect() {
             _wsRefreshing = true;
             tryRefreshToken().then(ok => {
                 _wsRefreshing = false;
-                _wsFailCount = 0;
-                _wsReconnectMs = 0;
-                _wsConn = null;
-                setTimeout(_wsConnect, 100);
+                if (ok) {
+                    _wsFailCount = 0;
+                    _wsReconnectMs = 0;
+                    _wsConn = null;
+                    setTimeout(_wsConnect, 100);
+                } else {
+                    redirectLogin();
+                }
             }).catch(() => {
                 _wsRefreshing = false;
                 _wsReconnectMs = Math.min(_wsReconnectMs * 2 + 1000, 15000);