fix: harden dashboard RBAC and cookie auth flows

Restrict Docker/Files writes to admins, move terminal websocket auth to cookie-first with temporary query fallback, and migrate refresh-token handling to httpOnly cookies for safer session persistence.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dashboard/frontend/src/routes/Terminal.svelte

@@ -1,7 +1,7 @@
 <script>
   import { onMount, onDestroy } from "svelte";
   import { VoiceSession } from "../lib/voice.js";
-  import { getWebSocketToken } from "../lib/api.js";
+  import { tryRefreshSession } from "../lib/api.js";
 
   const PERSISTENCE_STATUS_PREFIX = "__DASHBOARD_PERSISTENCE__:";
   const PERSISTENCE_STATUS_PREFIX_BYTES = new TextEncoder().encode(PERSISTENCE_STATUS_PREFIX);
@@ -253,14 +253,16 @@
       }
 
       async function connect(forceRefresh = false) {
-        const token = await getWebSocketToken(forceRefresh);
-        if (!token) {
-          handleAuthExpired();
-          return null;
+        if (forceRefresh) {
+          const refreshed = await tryRefreshSession();
+          if (!refreshed) {
+            handleAuthExpired();
+            return null;
+          }
         }
 
         const ws = new WebSocket(
-          `${proto}//${location.host}/ws/terminal?host=${encodeURIComponent(tab.hostId)}&token=${encodeURIComponent(token)}`
+          `${proto}//${location.host}/ws/terminal?host=${encodeURIComponent(tab.hostId)}`
         );
         ws.binaryType = "arraybuffer";
 
@@ -307,9 +309,9 @@
           if (e.code === 1008 && reason === "Unauthorized") {
             if (!closedManually && !authRecoveryInFlight) {
               authRecoveryInFlight = true;
-              const recoveredToken = await getWebSocketToken(true);
+              const refreshed = await tryRefreshSession();
               authRecoveryInFlight = false;
-              if (recoveredToken) {
+              if (refreshed) {
                 reconnecting = true;
                 updateTab(tabId, {
                   connected: false,