fix: remove dead auth_refresh code, fix logout storage, align bootstrap TTL, add hash rehash, tighten CSP

- Remove duplicate dead code in daemon/handlers/auth.py (auth_refresh)
- Fix logout reading refresh token from localStorage instead of sessionStorage
- Align bootstrap auth config access_token_ttl (900 -> 300) with hardened default
- Add password hash rehash check on successful login (needs_rehash was unused)
- Remove 'unsafe-inline' from CSP style-src (all styles are applied via JS DOM API)

webui/static/hoover/components/auth.js

@@ -69,7 +69,7 @@ export async function logout() {
                 'Accept': 'application/json',
                 'Authorization': 'Bearer ' + token,
             };
-            const refresh = localStorage.getItem('vw:refresh');
+            const refresh = sessionStorage.getItem('vw:refresh');
             await fetch('/api/auth/logout', {
                 method: 'POST',
                 headers,