auth: make session binding optional, enforce WebAuthn credential ownership

- Make session_id parameter optional in validate_token — only enforced when
  provided, allowing WebSocket auth which cannot carry custom headers
- Remove decode_token round-trip from daemon WS handler
- Override WebAuthn registration username from JWT user_ctx to prevent users
  from registering credentials under another user's account
- Frontend no longer sends username for WebAuthn registration
- Redirect to login on 401 after token refresh fails for POST requests
- Remove redundant auth session check from login page load
- Add tests for session_id semantics and WebAuthn ownership guard

webui/static/pages/login.js

@@ -209,21 +209,9 @@ const Page = definePage({
         document.title = 'Login — Vacuum Wall';
     },
 
-    async load(state, abortController) {
+    load() {
         handleLogin();
         setupPasskeyButton();
-
-        if (getAuthToken()) {
-            try {
-                const res = await apiFetch('/api/auth/session', { signal: abortController?.signal });
-                if (res.ok) {
-                    window.location.hash = '/dashboard';
-                    return;
-                }
-            } catch {
-                // auth check failed, show login
-            }
-        }
     },
 
     render() {