Security hardening: token-at-rest, rate limiting, XSS, transactions

- auth: impersonate stores empty data instead of raw cookie; unimpersonate
  issues a fresh session rather than replaying a stored token
- api/index.php: restore rate limiting (10 req/min auth, 120 general)
- nova.js: 401 redirects to login instead of silently returning error;
  escHtml now escapes single quotes to prevent onclick XSS
- accounts: wrap ownership-change 4-write path in beginTransaction/commit;
  restore audit body on account.update
- reseller/user login cards: use $_pname instead of hardcoded 'NovaCPX'

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

panel/api/endpoints/accounts.php

@@ -97,6 +97,8 @@ match ($action) {
             [$id]
         );
         if (!$acct) Response::error("Account not found", 404);
+        $db->beginTransaction();
+        try {
 
         $allowed = ['php_version', 'package_id', 'notes'];
         $sets = []; $params = [];
@@ -203,8 +205,13 @@ match ($action) {
             }
         }
 
-        audit('account.update', "account:$id");
+        $db->commit();
+        audit('account.update', "account:$id", $body);
         Response::success(null, 'Account updated');
+        } catch (Throwable $e) {
+            $db->rollBack();
+            throw $e;
+        }
     })(),
 
     'suspend' => (function() use ($db, $body, $ownerClause) {