Audit and harden the auth path end-to-end.
- Confirm AuthManager.validateApiKey() return shape matches what AgentServer.js expects
- Confirm JWT-first behavior remains unchanged
- Ensure invalid/missing credentials fail cleanly with no server crash
- Remove any duplicate or conflicting auth helper logic if present
- Make sure API-key user metadata is sufficient for WS session attribution