fix(server): verify session/machine ownership at websocket connection time

[ex3ndr-bot]

Summary

This PR fixes issue #761 where happy-agent send fails because the agent.key token lacks a session claim that the websocket connection requires.

Problem

• Terminal auth (/v1/auth/request) creates tokens WITH session claims: { session: answer.id }
• Account auth (/v1/auth/account/request) creates tokens WITHOUT session claims
• happy-agent uses account auth, so its tokens don't have session claims
• While the websocket didn't explicitly require session claims in the JWT, proper authorization validation was missing

Solution

Instead of requiring session claims in the JWT (which wouldn't make sense for account-scoped tokens), we now verify session/machine ownership via database lookup at websocket connection time.

Changes

1. Added db import to socket.ts
2. For session-scoped connections: verify the session belongs to the authenticated user via DB lookup
3. For machine-scoped connections: verify the machine belongs to the authenticated user via DB lookup

This approach:

• ✅ Allows account tokens (from /v1/auth/account/request) to work with session-scoped connections
• ✅ Maintains security by verifying the session belongs to the authenticated user
• ✅ Adds consistent validation for machine-scoped connections as well
• ✅ Rejects unauthorized connections early, before any handlers are registered

Testing

The fix adds proper authorization checks at the websocket connection layer. The existing tests for session operations (which verify accountId: userId) continue to provide defense in depth.