fix: stop aggressive API polling and SSE reconnect when auth lost

When unauthenticated (TOTP gate active), the dashboard was polling
/api/v1/services/status every few seconds and reconnecting SSE every
2-8s indefinitely. Now: 401/403 sets _dcAuthLost flag to skip the
polling interval, and SSE stops after 5 consecutive failures.

status/js/core/grid.js

@@ -401,9 +401,15 @@
     refreshInFlight = (async () => {
       try {
         const response = await fetch('/api/v1/services/status', { cache: 'no-store' });
+        if (response.status === 401 || response.status === 403) {
+          // Auth lost — stop the polling loop from hammering every few seconds
+          window._dcAuthLost = true;
+          throw new Error(`Authentication required (${response.status})`);
+        }
         if (!response.ok) {
           throw new Error(`Status refresh failed (${response.status})`);
         }
+        window._dcAuthLost = false; // auth working again
         const data = await response.json();
         applyBatchResults(data.statuses || {});
         updateStamp('last check', data.checkedAt || new Date());

status/js/core/init.js

@@ -63,7 +63,12 @@
     window.buildGrid();
     animateTopCards();
     window.refreshAll();
-    setInterval(window.refreshAll, DC.POLL.DASHBOARD);
+    setInterval(() => {
+      // Stop polling if the session has been invalidated (e.g. TOTP gate
+      // now active, or user logged out). Avoids relentless 401/403 noise.
+      if (window._dcAuthLost) return;
+      window.refreshAll();
+    }, DC.POLL.DASHBOARD);
     if (typeof window.refreshCredsButtons === 'function') window.refreshCredsButtons();
     if (typeof window.refreshMonitoringWidgets === 'function') window.refreshMonitoringWidgets();
     // Update auth card (may have already been updated by the auto-load IIFE but ensure it's correct)