auth: make session binding optional, enforce WebAuthn credential ownership

- Make session_id parameter optional in validate_token — only enforced when
  provided, allowing WebSocket auth which cannot carry custom headers
- Remove decode_token round-trip from daemon WS handler
- Override WebAuthn registration username from JWT user_ctx to prevent users
  from registering credentials under another user's account
- Frontend no longer sends username for WebAuthn registration
- Redirect to login on 401 after token refresh fails for POST requests
- Remove redundant auth session check from login page load
- Add tests for session_id semantics and WebAuthn ownership guard

webui/static/hoover/api.js

@@ -165,6 +165,10 @@ export async function apiFetch(url, options = {}) {
         if (res.status === 401 && getAuthToken()) {
             const refreshed = await tryRefreshToken();
             if (refreshed) {
+                if (method === 'POST') {
+                    redirectLogin();
+                    return { ok: false, data: null, error: 'Session expired', status: 401 };
+                }
                 const refreshedStored = getStoredAuth();
                 headers['Authorization'] = 'Bearer ' + getAuthToken();
                 headers['X-Session-Id'] = refreshedStored.session_id;