fix: harden dashboard RBAC and cookie auth flows

Restrict Docker/Files writes to admins, move terminal websocket auth to cookie-first with temporary query fallback, and migrate refresh-token handling to httpOnly cookies for safer session persistence.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dashboard/frontend/src/routes/Login.svelte

@@ -1,5 +1,5 @@
 <script>
-  import { login, setToken, setRefreshToken, get, post } from "../lib/api.js";
+  import { login, setToken } from "../lib/api.js";
   import { fade, fly } from "svelte/transition";
 
   let username = $state("");
@@ -56,7 +56,6 @@
       if (!res.ok) { const e = await res.json(); throw new Error(e.detail || "Passkey verification failed"); }
       const data = await res.json();
       setToken(data.access_token);
-      setRefreshToken(data.refresh_token);
       window.location.reload();
     } catch (e) {
       if (e.name === "NotAllowedError") { error = "Passkey authentication cancelled"; }
@@ -79,7 +78,6 @@
       const res = await login(payload); // api.js helper sends JSON
       
       setToken(res.access_token);
-      setRefreshToken(res.refresh_token);
       // Determine if we need to reload or just update state. 
       // Reload is safest to clear any stale state.
       window.location.reload();