Correlate WebSocket auth with the originating TCP socket

[TristanInSec]

Summary

The HTTP upgrade handler and the SockJS connection handler in server.js previously passed the proxy auth token and user id between themselves via two shared closure variables (authToken, userid). Those variables are module-scoped to the promise callback, so they are last-writer-wins across every in-flight upgrade. Under concurrent load a connection could observe the credentials written by a different upgrade that happened to interleave between its own upgrade event and its own connection event.

This PR keys the pending auth entries on the TCP socket's remoteAddress:remotePort pair, which is guaranteed unique per live socket. The SockJS connection event retrieves the entry using the same key, so each connection deterministically picks up the credentials from its own upgrade. The entry is removed on connection pickup, socket close, or socket error to keep the map bounded.

Changes

• Introduce pendingAuth Map keyed by ${remoteAddress}:${remotePort}.
• Store the auth token + user id from the upgrade handler into the map after the origin check.
• Read (and delete) the matching entry in the SockJS connection handler before creating the Aggregator.
• Clean up stale entries on socket close/error so unmatched upgrades do not accumulate.

Test plan

• Existing tests continue to pass.
• Manual check: in proxy mode, a single client connects and the Aggregator observes the expected authToken / userid.
• Manual check: many concurrent connections each see the credentials from their own upgrade.