Added websocket hub for handling websocket clients, with a wsserve command

which runs a plain TCP server for receiving websocket hub clients, with
server config, CSRF and rate limit middleware.

- internal/websocket: Hub pushing messages to WebSocket clients (ServeHTTP,
  example.com/ws upgrade with optional CSRF check) and plain TCP clients (ServeTCP,
  newline-delimited JSON envelopes); ping/pong keepalive, per-client message
  rate limit, slow consumer handling, graceful Shutdown, debug logging of
  messages sent and received
- internal/websocket/tcpserver: standalone TCP server for a hub, with accept
  back-off, a per-IP connection limit (server.websocket.connection_limit) and
  graceful shutdown
- internal/cli/wsserve: `wsserve` command running the TCP server, with
  --listen/--host/--port overrides
- internal/middleware: keyed token bucket rate limiter, real client IP from
  trusted proxies
- internal/httpx: RFC 9457 problem responses, request IDs in context
- internal/config: server section (host, port, shutdown timeout, rate limiter
  idle TTL, websocket); util.ByteSize settings (e.g. "32KiB"); lists of
  sections as single keys; empty lists stored as nil; isExplicitlySet for
  printLoadedConfig; JobSearchConfigSource renamed to JSCSourcesSource;
  TestSections checks every section's methods
- internal/util: ByteSize, parsed and formatted with go-humanize

internal/websocket/messages.go

@@ -0,0 +1,64 @@
+// Package websocket implements the hub that pushes messages to connected
+// clients: WebSocket clients upgraded by Hub.ServeHTTP (the /ws endpoint) and
+// plain TCP clients run by Hub.ServeTCP, which send the same messages as
+// newline-delimited JSON (see tcp.go). Package tcpserver runs a TCP server
+// for those clients.
+//
+// Every message is a JSON Envelope: a WebSocket text frame, or one line on
+// TCP.
+//
+// Client -> server:
+//
+//	{"type":"ping","id":"1"}
+//	{"type":"echo","id":"2","payload":{...}}
+//
+// Server -> client:
+//
+//	{"type":"welcome","payload":{"clientId":"..."}}
+//	{"type":"pong","id":"1","payload":{"time":"..."}}
+//	{"type":"echo","id":"2","payload":{...}}
+//	{"type":"error","id":"3","error":"..."}
+//	{"type":"item.created","payload":{...}}
+//
+// Any other type from a client gets an "unknown message type" error. The last
+// message is one sent by Hub.Push: its type is the pushed message type.
+package websocket
+
+import "encoding/json"
+
+// Envelope is the wire format for every message in both directions.
+type Envelope struct {
+	Type    string          `json:"type"`
+	ID      string          `json:"id,omitempty"`
+	Payload json.RawMessage `json:"payload,omitempty"`
+	Error   string          `json:"error,omitempty"`
+}
+
+// Envelope types. TypeEvent, TypeRequest and TypeAck are reserved: nothing
+// sends or handles them yet.
+const (
+	TypeWelcome = "welcome"
+	TypePing    = "ping"
+	TypePong    = "pong"
+	TypeEcho    = "echo"
+	TypeEvent   = "event"
+	TypeRequest = "request"
+	TypeAck     = "ack"
+	TypeError   = "error"
+)
+
+// mustRaw returns v as raw JSON: v itself if it is already json.RawMessage,
+// nil if v is nil or can't be marshalled.
+func mustRaw(v any) json.RawMessage {
+	if v == nil {
+		return nil
+	}
+	if raw, ok := v.(json.RawMessage); ok {
+		return raw
+	}
+	b, err := json.Marshal(v)
+	if err != nil {
+		return nil
+	}
+	return b
+}