Validate the auth matrix and crash safety.
Test:
- JWT WS connection succeeds
- API key WS connection succeeds
- Missing creds are rejected gracefully
- Invalid JWT is rejected
- Invalid API key is rejected
- Existing HTTP auth routes still work
- Existing SSE consumers still work
- Server remains stable after repeated bad auth attempts