[1.0] Authenticate WebSockets and enforce per-recipient visibility

The HTTP authentication middleware skips WebSocket scopes, the socket accepts connections, and broadcast sends the same artifact-bearing event to all clients.

Scope

• Bind each connection to the authenticated identity from the supported access path.
• Authorize each outgoing artifact, diagnostic and streaming event for its recipient, including graph/count metadata that could reveal protected work.
• Make reconnect and identity/permission changes invalidate stale authorization rather than retaining previous access.

Acceptance criteria

• A deny-all authentication setup rejects a real WebSocket handshake as well as HTTP requests.
• Two differently authorized connected clients receive only their permitted payloads and metadata; anonymous clients cannot observe protected work.
• Reconnect and changed permissions cannot preserve an earlier identity's access; authorized live updates still work.

Boundaries

No new streaming transport or workflow engine.

References

• Parent topic: #280.
• Implementation dependencies: #430.
• src/flock/components/server/websocket/websocket_component.py
• src/flock/api/websocket.py
• src/flock/api/collector.py

Start by reading src/flock/components/server/websocket/websocket_component.py, src/flock/api/websocket.py, and src/flock/api/collector.py, along with dependency #430 and parent topic #280. Trace the supported authentication path, connection identity, and broadcast payloads before running or adding tests for denied handshakes, differently authorized clients, reconnects, and permission changes. Done means protected artifacts, diagnostics, streams, and metadata are visible only to permitted recipients.