fix: remove dead auth_refresh code, fix logout storage, align bootstrap TTL, add hash rehash, tighten CSP

- Remove duplicate dead code in daemon/handlers/auth.py (auth_refresh)
- Fix logout reading refresh token from localStorage instead of sessionStorage
- Align bootstrap auth config access_token_ttl (900 -> 300) with hardened default
- Add password hash rehash check on successful login (needs_rehash was unused)
- Remove 'unsafe-inline' from CSP style-src (all styles are applied via JS DOM API)

daemon/handlers/auth.py

@@ -195,31 +195,6 @@ def auth_refresh(_request: Any, body: Any) -> dict[str, Any]:
         },
         "permissions": permissions,
     }
-    if payload is None:
-        raise ValueError("Invalid or expired refresh token")
-
-    username = payload["sub"]
-    user = get_user(username)
-    if user is None:
-        raise ValueError("User not found")
-
-    jti = payload.get("jti")
-    if jti:
-        blacklist_token(jti, token_type="refresh")
-    if username:
-        _clear_refresh_token_after_rotation(username)
-    permissions = user["permissions"]
-    tokens = generate_tokens(username, permissions)
-
-    return {
-        "tokens": tokens,
-        "access_ttl": get_access_ttl(),
-        "user": {
-            "id": user["id"],
-            "username": user["username"],
-        },
-        "permissions": permissions,
-    }
 
 
 @registry.register(GET_AUTH_SESSION)