fix-spa-review-findings (ornith-35): fetch timeout+res.ok, AuthSection loop fix, me() timeout, enable2fa finally, TOTP mask toggle, snapshot backoff, dup key removed

Cross-review by qwopus35b pending. SPA lint 2/2 green.

app/src/components/OverviewPanel.tsx

@@ -17,12 +17,43 @@ export function OverviewPanel() {
   useEffect(() => {
     let cancelled = false;
     setLoading(true); setError(null);
-    const load = () => api.market.snapshot(symbol)
-      .then((s) => { if (!cancelled) { setSnap(s); setLoading(false); } })
-      .catch((e) => { if (!cancelled) { setError(e instanceof Error ? e.message : "request failed"); setLoading(false); } });
+    let consecutiveErrors = 0;
+    const BASE_INTERVAL = 5_000;
+    const MAX_INTERVAL = 30_000;
+    const load = () => {
+      api.market.snapshot(symbol)
+        .then((s) => {
+          if (!cancelled) {
+            setSnap(s);
+            setLoading(false);
+            consecutiveErrors = 0; // reset backoff on success
+          }
+        })
+        .catch((e) => {
+          if (!cancelled) {
+            setError(e instanceof Error ? e.message : "request failed");
+            setLoading(false);
+            consecutiveErrors++;
+          }
+        });
+    };
     load();
-    const t = setInterval(load, 5000); // poll for SWR refresh
-    return () => { cancelled = true; clearInterval(t); };
+    // Jittered backoff: 5s base, up to 30s max, with +/- 20% jitter.
+    const scheduleNext = () => {
+      if (cancelled) return;
+      const backoffMs = Math.min(
+        BASE_INTERVAL * Math.pow(2, Math.min(consecutiveErrors - 1, 3)),
+        MAX_INTERVAL
+      );
+      const jitter = backoffMs * (0.8 + Math.random() * 0.4);
+      t = setTimeout(scheduleNext, jitter);
+    };
+    let t: ReturnType<typeof setTimeout>;
+    scheduleNext();
+    return () => {
+      cancelled = true;
+      if (t) clearTimeout(t);
+    };
   }, [symbol]);
 
   const q = snap?.quote ?? null;