feat(ws): opt-in allowed origins and observer key

[MrAlders0n]

Two opt-in WebSocket additions so another site can embed the live feed. Both are off by default, so existing installs and clients see no change.

• websocket.allowed_origins lets listed sites open /ws from the browser. Entries must be exact scheme://host[:port]; wildcards, paths and non-http(s) schemes stop startup. Same-host connections work as before, and anything unlisted still gets 403.
• configure {includeObserverKey: true} adds observation.observerPublicKey to that connection's packetObservation events. Clients that don't ask get byte-identical events, and ingest only builds the extra payloads while someone has opted in.

The configured reply now echoes includeObserverKey alongside resolvePath. It's additive, and v stays 1.

Example:

websocket:
  allowed_origins:
    - https://example.com

Tests cover origin matching, config validation, the hub's payload selection and opt-in count, and the ingest variants. No swagger change.