feat: add API-key-gated WebSocket support

[prd-carapulse]

Adds opt-in WebSocket transport to eRPC.

• gates upgrades per auth strategy with allowWebsocket: true; HTTP-only API keys stay denied
• validates every text frame and JSON-RPC batch; reapplies project/auth method filters and rate limits per method
• rejects binary/malformed frames and database-auth fail-open sessions
• adds validated/redacted per-upstream websocketEndpoint
• selects eligible eth_subscribe upstreams in policy order and fails over on bounded dial failures
• bypasses HTTP buffering safely, clears HTTP deadlines, owns connection contexts, and closes hijacked sockets during shutdown
• bounds per-user connections, idle time, dial time, frame size, and maximum lifetime
• enforces configured browser origins

Validation:

• TDD RED commit confirmed missing behavior
• Go build and package tests
• focused WebSocket bridge, method-boundary, batch, failover, route, CORS, and resource-limit tests
• fallback config and Go module validation
• security and TypeScript config jobs
• Wiz SAST, secret, IaC, dependency, and data scans

Requested by: @DevAtom (Slack)

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review for a one-time review, or @claude review always to subscribe this PR to a review on every future push.

_{Tip: disable this comment in your organization's Code Review settings.}

[aikido-pr-checks]

SupportsMethod never blocks non-matching methods when AllowMethods is set alone; allowed starts true and is never turned false on allow-list misses.

Suggested change

	allowed := true
	allowed := len(p.Config.AllowMethods) == 0

Details

✨ AI Reasoning
​The new method appears to enforce project-level method filtering, but its control flow cannot deny methods when only an allow-list is configured. It starts in an allowed state, only toggles false inside ignore matches, and allow checks only ever set true. So a non-matching method still remains allowed, which contradicts the intended meaning of an allow-list gate.

_{Reply @AikidoSec feedback: [FEEDBACK] to get better review comments in the future.
Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}