CVE-2026-28412: DirectorServer WebSocket has no auth, no connection cap, broadcasts on main thread

CVE-2026-28412 was addressed upstream in [`3524fa96`](https://github.com/f/textream/commit/3524fa96f98ba17025b48ce9e19d49d859fc2ec1) ("Merge commit from fork"). Looking at `Textream/Textream/DirectorServer.swift` on `main`, none of the protections from that commit appear to have landed:

- no `private let maxConnections = 5` field, and `handleWSConnection` still appends to `wsConnections` unconditionally --- a client can keep opening WS connections until resources are exhausted (CWE-400).
- no `authenticatedConnections: Set` set, no `authToken`, no auth handshake at all in this file. `broadcast(_:)` iterates `wsConnections` directly with no `authenticatedConnections.contains(...)` filter, so any peer that completes the WS upgrade receives `DirectorState` payloads (live transcribed text, audio levels, etc.).
- `broadcast` runs on the main queue (`conn.start(queue: .main)` is the only queue mentioned) --- the upstream patch introduces a dedicated `broadcastQueue` precisely so big fan-out doesn't stall the UI thread.

Three independent gaps, all in one file --- the upstream commit is essentially a self-contained fix. Reported via port-credit-hunting.