fix: stop aggressive API polling and SSE reconnect when auth lost

When unauthenticated (TOTP gate active), the dashboard was polling
/api/v1/services/status every few seconds and reconnecting SSE every
2-8s indefinitely. Now: 401/403 sets _dcAuthLost flag to skip the
polling interval, and SSE stops after 5 consecutive failures.

status/js/live-events.js

@@ -11,6 +11,7 @@
 
     es.addEventListener('connected', () => {
       reconnectDelay = 1000; // reset backoff
+      _sseFailCount = 0; // reset failure counter
       debug('[SSE] Connected to event stream');
     });
 
@@ -101,12 +102,21 @@
     // Reconnect on error
     es.onerror = () => {
       es.close();
+      // Stop reconnecting entirely after multiple consecutive failures
+      // (likely auth-gate / session expired — no point hammering forever)
+      _sseFailCount = (_sseFailCount || 0) + 1;
+      if (_sseFailCount > 5) {
+        console.warn('[SSE] Max reconnect attempts reached — stopping (auth gate active or server unreachable)');
+        return;
+      }
       console.warn(`[SSE] Disconnected, reconnecting in ${reconnectDelay / 1000}s...`);
       setTimeout(connect, reconnectDelay);
       reconnectDelay = Math.min(reconnectDelay * 2, MAX_RECONNECT);
     };
   }
 
+  let _sseFailCount = 0;
+
   // Start on page load
   connect();