Collab Phase 1: Websocket Server Skeleton, Auth, and Presence Rooms

[cubap]

Summary

Add websocket infrastructure to TPEN-services for authenticated collaboration sessions and presence events.

Scope

• Initialize websocket server alongside HTTP server startup.
• Validate bearer tokens during websocket handshake.
• Authorize room joins by project permission.
• Support rooms: project:{projectId} and project:{projectId}:page:{pageId}.
• Emit and relay presence events: join, leave, cursor, selection.
• Feature flag websocket collaboration.

Acceptance Criteria

• Authenticated users can connect and join allowed rooms.
• Unauthorized joins are rejected.
• Presence fanout works for at least 2 concurrent users in same page room.
• Feature flag fully disables websocket endpoints.

Notes

Contract baseline: docs/collaboration/websocket-collaboration-contract.md