Fix SSE reconnect storm and document node dropout findings

- Fix stale EventSource accumulation: onerror handler now closes the
  existing EventSource before creating a new one, preventing multiple
  live instances from stacking up and flooding /api/nodes on reconnect.
- Add in-flight guard on /api/nodes fetch so concurrent requests are
  dropped if one is already in progress.
- Add dominant reason code column to Alerts tab (Most Impersonated
  Networks and Most Targeted Devices tables) and Sessions tab rows.
- README: document node dropout root cause (AP overwhelm on staggered
  power cycle), overnight stability confirmation, and dedicated AP todo.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -349,6 +349,16 @@ The **Bursts** section is the anomaly detector. A single unique source MAC gener
 
 Multi-node confirmation (`node_count > 1`, highlighted red) significantly raises confidence — it means the source is physically close and strong, not a distant weak signal.
 
+### Node dropout — AP overwhelm on simultaneous reconnect
+
+Observed 2026-04-06: three of four nodes dropped off the dashboard after being power cycled individually at different times. Symptoms included reason-15 deauth floods (`4-way handshake timeout`) from the affected nodes captured by the surviving node, and nodes getting stuck in a reconnect loop without ever successfully sending data to the coordinator.
+
+**Root cause:** the sandbox AP was overwhelmed by multiple nodes power cycling at slightly different times and hammering it with simultaneous association requests. Each node hops channels every ~4 seconds, briefly dropping and reconnecting to sandbox on every cycle. When several nodes do this at the same time after a staggered power cycle, the AP's association table fills with stale entries and stops completing WPA2 handshakes for new clients.
+
+**Confirmed not a firmware issue:** all four nodes ran for 21 hours continuously without a single drop when power cycled simultaneously (clean start, all connect at once). Heap stayed stable across all nodes throughout (234K–247K, no drift).
+
+**Mitigation:** power cycle all nodes at the same time rather than individually, so they all connect fresh together rather than in a staggered loop. Long-term fix is a dedicated AP for the nodes only, so their reconnect churn is isolated from regular network traffic and the AP is never competing with other clients.
+
 ### Our own networks
 
 To avoid investigating our own infrastructure, these SSIDs and BSSIDs are ours:
@@ -409,8 +419,12 @@ Broadcasting an open unauthenticated hotspot. Next step: connect via Parrot lapt
 - [x] Sessions tab — deauth events grouped into sessions by source MAC + 2-min gap, sortable, expandable rows
 - [x] Dashboard performance overhaul — fixed tab switch latency and Networks tab failing to load (see below)
 - [x] DB pruning / retention policy — background task deletes events older than HOT_DAYS every 6 hours
+- [x] Alerts tab — dominant reason code added to Most Impersonated Networks and Most Targeted Devices tables
+- [x] Sessions tab — dominant reason code + description shown per session row and in expanded detail panel
+- [x] SSE reconnect bug fix — multiple stale EventSource instances were accumulating on reconnect, flooding /api/nodes on tab re-open; fixed with proper close-before-reconnect and in-flight guard
 - [ ] Surface assoc events in dashboard (Search results or dedicated view)
 - [ ] Scan interval control from dashboard
+- [ ] Dedicated AP for nodes to isolate reconnect churn from regular network traffic
 
 ---