fix: ws web channel cors

[marrouchi]

What changed?

• Refactors API config parsing into shared helpers and adds reusable origin utilities.
• Tightens Socket.IO origin checks so web widget sockets use each web source’s allowed_domains, while console/admin - sockets use global allowed origins.
• Updates web channel CORS validation to normalize origins consistently and trims allowed domain settings.
• Adds a WEBSOCKET_GATEWAY injection token and updates workflow tests/services to use it.
• Adds unit coverage for parsing, origin matching, and Socket.IO origin policy behavior.