fix(server): authenticate websocket upgrades via session cookie

[Antisophy]

WebKit on old iOS Safari never attaches the basic-auth Authorization header to WebSocket upgrade requests, so /ws got a 401 on every attempt and the UI hung at "Connecting" forever.

Generate a random token from /dev/urandom when the transport's auth credentials are configured, hand it to clients as an HttpOnly session cookie on the first authenticated page response, and accept that cookie in checkAuth as an alternative to basic auth. Browsers do attach cookies to WebSocket handshakes, so the upgrade authenticates after one authenticated page load. No frontend changes needed.

The spec drives an authenticated page load, then replays the handshake condition directly: an upgrade carrying only the session cookie is accepted, and one carrying nothing stays rejected.

[CyberShadow]

The HTTP basic mechanism has a few flaws (incl. that a cached client will fail to connect as the credentials dialog will not show), but cookie based sessions need more consideration than this - e.g. a proper implementation likely involves switching to a classical login form, and more importantly, a new logout button in the UI to invalidate the session server side.