Collab Phase 1: Websocket Server Skeleton, Auth, and Presence Rooms

## Summary
Add websocket infrastructure to TPEN-services for authenticated collaboration sessions and presence events.

## Scope
- Initialize websocket server alongside HTTP server startup.
- Validate bearer tokens during websocket handshake.
- Authorize room joins by project permission.
- Support rooms: project:{projectId} and project:{projectId}:page:{pageId}.
- Emit and relay presence events: join, leave, cursor, selection.
- Feature flag websocket collaboration.

## Acceptance Criteria
- Authenticated users can connect and join allowed rooms.
- Unauthorized joins are rejected.
- Presence fanout works for at least 2 concurrent users in same page room.
- Feature flag fully disables websocket endpoints.

## Notes
Contract baseline: docs/collaboration/websocket-collaboration-contract.md

Start by reading docs/collaboration/websocket-collaboration-contract.md, then locate the HTTP server startup and existing feature-flag and authentication entry points. Map the handshake, room authorization, and presence-event requirements to the contract. Done means authenticated users can join permitted rooms, unauthorized joins are rejected, two users receive presence events, and the feature flag disables websocket endpoints.

Written by the indexing model from the issue text.