fix: harden dashboard RBAC and cookie auth flows

Restrict Docker/Files writes to admins, move terminal websocket auth to cookie-first with temporary query fallback, and migrate refresh-token handling to httpOnly cookies for safer session persistence.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dashboard/backend/routers/passkey.py

@@ -2,7 +2,7 @@
 import json
 import time
 from datetime import timedelta
-from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi import APIRouter, Depends, HTTPException, Request, Response
 from fastapi.responses import JSONResponse
 from slowapi import Limiter
 from slowapi.util import get_remote_address
@@ -112,7 +112,7 @@ async def passkey_login_options(request: Request):
 
 @router.post("/passkey/login/verify")
 @limiter.limit("10/minute")
-async def passkey_login_verify(request: Request):
+async def passkey_login_verify(request: Request, response: Response):
     """Verify passkey authentication and issue tokens."""
     body = await request.json()
     challenge = _get_challenge(body.get("response", {}).get("clientDataJSON", ""))
@@ -146,6 +146,7 @@ async def passkey_login_verify(request: Request):
         expires_delta=timedelta(minutes=config.ACCESS_TOKEN_EXPIRE_MINUTES),
     )
     refresh_token = auth.create_refresh_token(data={"sub": username, "role": "admin"})
+    auth.set_auth_cookies(response, access_token, refresh_token)
     return {
         "access_token": access_token,
         "refresh_token": refresh_token,