Operator WebSocket subscription

Upgrades the connection and subscribes to a session topic via Redis pubsub. Browser clients pass ?session_token= since they can’t set Authorization headers on a WS handshake; the kit’s auth middleware accepts both. Workspace also flows via ?workspace= query.