feat(auth): revalidate session on WS heartbeat #124

Description

WebSocket connections authenticate once at handshake (#122) and stay open even if the session row is deleted or the user deactivated. Re-check the session on each heartbeat and close with 4401/4403 when it no longer validates.

Why

Deletion/deactivation currently only takes effect on the next HTTP request; long-lived sockets bypass it.

Scope

• Session lookup in the heartbeat path
• Close codes 4401 (gone session) / 4403 (deactivated user)
• Tests with a fake clock