[grade=B] fix: stop aggressive API polling and SSE reconnect when auth lost

When unauthenticated (TOTP gate active), the dashboard was polling
/api/v1/services/status every few seconds and reconnecting SSE every
2-8s indefinitely. Now: 401/403 sets _dcAuthLost flag to skip the
polling interval entirely (no fallback to direct probes which
misleadingly mark services as healthy), SSE exposes _sseClose()
coordinated with _dcAuthLost, and queued refreshes are guarded.

status/js/live-events.js

@@ -3,9 +3,12 @@
   let es = null;
   let reconnectDelay = 1000;
   const MAX_RECONNECT = 30000;
+  let _sseFailCount = 0;
+  let _sseManuallyClosed = false;
 
   function connect() {
     if (es) { try { es.close(); } catch (_) {} }
+    if (_sseManuallyClosed) return; // auth-lost: don't reconnect
 
     es = new EventSource('/api/v1/events/stream');
 
@@ -102,11 +105,16 @@
     // Reconnect on error
     es.onerror = () => {
       es.close();
-      // Stop reconnecting entirely after multiple consecutive failures
-      // (likely auth-gate / session expired — no point hammering forever)
-      _sseFailCount = (_sseFailCount || 0) + 1;
+      // If auth was explicitly lost (401/403 from the polling loop),
+      // don't attempt reconnection at all.
+      if (window._dcAuthLost || _sseManuallyClosed) {
+        console.warn('[SSE] Auth lost — stopping reconnection');
+        return;
+      }
+      // Transient failures: retry with exponential backoff, stop after 5
+      _sseFailCount++;
       if (_sseFailCount > 5) {
-        console.warn('[SSE] Max reconnect attempts reached — stopping (auth gate active or server unreachable)');
+        console.warn('[SSE] Max reconnect attempts reached — stopping (server unreachable)');
         return;
       }
       console.warn(`[SSE] Disconnected, reconnecting in ${reconnectDelay / 1000}s...`);
@@ -115,11 +123,16 @@
     };
   }
 
-  let _sseFailCount = 0;
+  // Called by grid.js when the polling loop detects auth loss (401/403)
+  function closeAndStop() {
+    _sseManuallyClosed = true;
+    if (es) { try { es.close(); } catch (_) {} }
+  }
 
   // Start on page load
   connect();
 
-  // Expose for debugging
+  // Expose for debugging and cross-module coordination
   window._sseReconnect = connect;
+  window._sseClose = closeAndStop;
 })();