Forward-port preserved RFMS hardening

[Reedtrullz]

Summary

• complete the Boeing company-route MOD/EXEC action path
• normalize aircraft adapter capability aliases without adding capability data to unauthenticated health
• return HTTP 401 for rejected WebSocket authentication
• trim and validate connection URLs and associate the URL label
• harden wake-lock acquisition and release races
• isolate Playwright on a validated strict loopback port

Validation

• format check passed
• lint passed with existing repository warnings only
• all-workspace typecheck passed
• unit suite passed: 69 files, 870 tests
• coverage thresholds passed
• production build passed
• status-doc consolidation passed
• visual-manifest measurement passed with the existing no-approved-hardware-reference warning
• production dependency audit passed at high severity; two low findings remain
• Playwright CI smoke passed: 3 tests
• invalid ports 0, 65536, and abc rejected; an occupied strict port fails closed
• independent review found no blockers

Non-claims

The optional full all-device browser matrix was attempted but current baseline failures in unrelated cockpit flows and visual snapshots appeared before completion. This PR does not refresh those baselines and does not claim physical iPad or Windows/MSFS/PMDG validation.