85d8770ba6
- lib/auth: make RateLimiter.is_allowed read-only (no dict mutation on read) - daemon/server: add periodic blacklist_expired cleanup to poll loop (60s interval) - daemon/server: negotiate only matched Bearer subprotocol on WebSocket connect - webui/server: rewrite _is_personal_auth with path-prefix matching, cover WebAuthn register routes - daemon/handlers/auth: eliminate redundant get_user call in auth_update_user