Extract shared WebSocket authentication helper in ws.get.ts

[BillyOutlast]

Source

PR #191 review threads:

• duplicate auth logic
• complete token auth setup

Problem

The open and message handlers in ws.get.ts duplicate authentication logic:

1. Create h3 headers object
2. Call getUserIdACL with notifications:listen
3. Call fetchAllACLs
4. Call notificationSystem.listen
5. Send unauthenticated on failure

Fix

Extract a shared authenticatePeer helper:

async function authenticatePeer(
  peer: Parameters<typeof defineWebSocketHandler>[0]['open'] extends (p: infer P) => any ? P : never,
  headers: Headers,
): Promise<boolean> {
  const h3 = { headers };
  const userId = await aclManager.getUserIdACL(h3, ["notifications:listen"]);
  if (!userId) return false;
  const acls = await aclManager.fetchAllACLs(h3);
  if (!acls) return false;
  socketSessions.set(peer.id, userId);
  notificationSystem.listen(userId, acls, peer.id, (notification) => {
    peer.send(JSON.stringify(notification));
  });
  return true;
}

Both open and message handlers call authenticatePeer instead of duplicating.

Relates: #191