fix: remove dead auth_refresh code, fix logout storage, align bootstrap TTL, add hash rehash, tighten CSP

- Remove duplicate dead code in daemon/handlers/auth.py (auth_refresh)
- Fix logout reading refresh token from localStorage instead of sessionStorage
- Align bootstrap auth config access_token_ttl (900 -> 300) with hardened default
- Add password hash rehash check on successful login (needs_rehash was unused)
- Remove 'unsafe-inline' from CSP style-src (all styles are applied via JS DOM API)

lib/auth_users.py

@@ -27,7 +27,7 @@ from lib.db import (
     Q_UPSERT_PERMISSION,
     get_db,
 )
-from lib.password import hash_password, verify_password
+from lib.password import hash_password, needs_rehash, verify_password
 
 logger = logging.getLogger(__name__)
 
@@ -116,6 +116,11 @@ def verify_user_password(username: str, password: str) -> dict[str, Any] | None:
         return None
     if not verify_password(password, user["password_hash"]):
         return None
+    if needs_rehash(user["password_hash"]):
+        new_hash = hash_password(password)
+        db = get_db()
+        db.run(Q_UPDATE_PASSWORD, (new_hash, username))
+        logger.info("Password hash rehashed for %r (param upgrade)", username)
     return {
         "id": user["id"],
         "username": user["username"],