feat(portal): live ~1Hz WS stream with auto-close (visibility + idle cap)

The portal location view is now genuinely live, not a 15s poll. Scoped WS endpoint
/portal/api/location/{id}/stream: authenticates via the session cookie, enforces
ownership (resolve_client_location), then bridges the unit's shared SLMM /monitor
fan-out feed to the browser — a viewer is just one more subscriber, no extra
device connection. Frames are scrubbed to the portal whitelist (drops unit_id,
raw_payload, counter, lmin) before reaching the client.

location.html: cache prefill for instant first paint, then upgrades to the live
socket (cards tick ~1Hz, chart scrolls). Auto-close so an abandoned tab can't pin
the device at 1Hz polling (~8x cellular data):
- closes when the tab is hidden, reopens when visible (Page Visibility) — the main
  guard;
- hard 15-min cap -> "Live paused — click to resume" overlay.

Refactor: client_from_cookie() extracted from get_current_client so the WS handler
(no Request-based Depends) can auth the same way.

Verified: scrub drops internal fields / keeps metrics + heartbeat (7/7), auth
refactor (3/3), portal compiles, location.html JS balances + parses.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/portal_auth.py

@@ -82,20 +82,24 @@ def _read_session_cookie(value: str):
 
 # -- the dependency every portal route uses ---------------------------------
 
-def get_current_client(request: Request, db: Session = Depends(get_db)) -> Client:
-    """Resolve the authenticated client, or raise PortalAuthError.
-
-    Re-validates the access token on every request so a revoked link / disabled
-    client drops the session immediately."""
-    cookie = request.cookies.get(COOKIE_NAME)
-    token_id = _read_session_cookie(cookie) if cookie else None
+def client_from_cookie(cookie_value, db: Session):
+    """Resolve a Client from a raw session-cookie value, or None. Re-validates the
+    access token against the DB each call, so a revoked link / disabled client
+    drops immediately. Shared by the HTTP dependency and the WebSocket handler
+    (which can't use Request-based Depends)."""
+    token_id = _read_session_cookie(cookie_value) if cookie_value else None
     if not token_id:
-        raise PortalAuthError()
+        return None
     tok = db.query(ClientAccessToken).filter_by(id=token_id, revoked_at=None).first()
     if not tok:
-        raise PortalAuthError()
-    client = db.query(Client).filter_by(id=tok.client_id, active=True).first()
-    if not client:
+        return None
+    return db.query(Client).filter_by(id=tok.client_id, active=True).first()
+
+
+def get_current_client(request: Request, db: Session = Depends(get_db)) -> Client:
+    """Resolve the authenticated client, or raise PortalAuthError."""
+    client = client_from_cookie(request.cookies.get(COOKIE_NAME), db)
+    if client is None:
         raise PortalAuthError()
     return client