feat: add WebSocket support via Gorilla WebSocket

[GRACENOBLE]

Summary

Add real-time bidirectional communication to the backend using github.com/gorilla/websocket, enabling the web and mobile clients to receive live updates without polling.

Scope

Backend (Go)

• Add github.com/gorilla/websocket dependency
• Add a WebSocketHub in internal/infrastructure/ws/ that manages connected clients, broadcasts messages, and handles disconnections
• Expose a GET /ws upgrade endpoint in routes.go — authenticated via Firebase token query param or Upgrade header (ties into feat: add Firebase Authentication across all app layers #15)
• Wire the Hub into server.go as a long-lived goroutine alongside the HTTP server
• Publish events to the Hub from Asynq workers or Redis Streams consumers (feat: integrate Asynq + Redis Streams for background jobs and event-driven messaging #18) so job completions and domain events reach connected clients in real time

Web (Next.js)

• Add a useWebSocket hook in lib/ that opens the connection, handles reconnection with exponential backoff, and exposes incoming messages
• Attach the Firebase ID token on connect for authentication
• Typed message envelope: { type: string; payload: unknown } — discriminated union for known event types

Mobile (Android / Jetpack Compose)

• Add OkHttp WebSocket client (already available transitively via Retrofit/OkHttp)
• Manage the connection in a WebSocketManager singleton or scoped to a ViewModel
• Reconnect on network change; pass Firebase token on handshake

Acceptance criteria

• GET /ws upgrades to a WebSocket connection and rejects unauthenticated requests with 401
• Hub broadcasts a message to all connected clients when an event is published (e.g. job completed from feat: integrate Asynq + Redis Streams for background jobs and event-driven messaging #18)
• Web useWebSocket hook receives and surfaces live messages in a component
• Android client receives live messages while foregrounded
• Hub cleans up disconnected clients without goroutine leaks
• Hub tested with concurrent connect/disconnect/broadcast (unit test with mock conns)
• Docs added to backend/docs/websocket.md and web/docs/websocket.md

Dependencies

• feat: add Firebase Authentication across all app layers #15 Firebase Auth — token validated on WebSocket handshake
• feat: integrate Asynq + Redis Streams for background jobs and event-driven messaging #18 Asynq + Redis Streams — job/event completions are the primary broadcast trigger