bug: WebSocket ticket flow is broken — WSJWTAuth middleware aborts before handler checks ticket

[deannos]

Description

The /ws route applies WSJWTAuth as middleware. WSJWTAuth looks for ?token= or a Bearer header — not ?ticket=. A client using the ticket flow (GET /ws?ticket=...) has no JWT at that point, so the middleware aborts with 401 before the handler ever runs. The ticket branch in WebSocketHandler is unreachable via the intended ticket flow.

Location

• router/router.go:66
• handlers/ws_handler.go:36–49

Steps to Reproduce

1. Call GET /api/v1/ws/ticket with a valid JWT → receive a ticket
2. Connect to GET /ws?ticket=<ticket> (no ?token= param) → 401 Unauthorized

Expected

WebSocket upgrades successfully using the one-time ticket.

Fix

Move all auth logic (both ticket and JWT) inside WebSocketHandler and remove WSJWTAuth from the /ws route registration.