Add the core WebSocket infrastructure:
- Message type definitions for the wire protocol (subscribe, unsubscribe,
auth, error, push events)
- In-memory connection hub that tracks per-user connections and routes
messages to subscribed clients
- Connection wrapper with auth-after-connect flow: connections start
unauthenticated, client sends JWT as first message, only then can
subscribe to event topics
Includes auth timeout (30s), shared cancellation context for read/write
loops, hub map cleanup on last connection removal, and proper error
delivery before closing on auth failure.
