websocket: create AutoSession session only on accepted handshakes

[linkdata]

Summary

• With Jaws.AutoSession enabled, any request carrying a nonempty Sec-WebSocket-Key registered a session and wrote its Set-Cookie before websocket.Accept validated the handshake, so a malformed/rejected handshake left an orphaned session resident for the grace period and a session cookie on the error response.
• Defer session creation to the handshake commit point: coder/websocket.Accept writes 101 Switching Protocols through the http.ResponseWriter it is given right before hijacking the connection, so a thin autoSessionWriter wrapper creates and attaches the session (and its cookie) inside WriteHeader only when the status is 101. On any rejection the hook never fires — no session, no cookie, nothing to roll back.
• The wrapper forwards Unwrap so Accept still locates the http.Hijacker (http.ResponseController convention), and WriteHeaderNow so gin's deferred header flush keeps working.
• Non-AutoSession and already-has-session paths pass the original writer unchanged.
• Tightened the AutoSession field doc to match the README: the session is created during a successful WebSocket upgrade.

Tests

• New TestWS_AutoSessionFailedHandshakeDoesNotCreateSession sends raw HTTP handshakes with defects only websocket.Accept catches (missing Connection/Upgrade headers per the issue repro; unsupported Sec-WebSocket-Version) and asserts the error status, no Set-Cookie, SessionCount() == 0, and a nil request session. Both variants fail against the previous behavior (cookie set, session registered) and pass with this change.
• New TestAutoSessionWriter_ForwardsWriteHeaderNow covers the gin-forwarding branch.
• gofmt -l, go vet ./..., staticcheck ./..., golangci-lint run, gosec -quiet ./... all clean; go test -race ./... passes with 100.0% statement coverage on the root package.

Closes #139