fix(desktop): own native WebSocket lifecycle

[tlongwell-block]

Summary

• replace tauri-plugin-websocket with a small Buzz-owned tokio-tungstenite lifecycle adapter
• isolate each connection behind a bounded queue and cancellable owner task, with native connect/write deadlines and EOF/error cleanup
• add authoritative disconnect / disconnect_all commands and tear down native sockets before Cmd+R reload
• register explicit Tauri ACL permissions and update the browser test bridge

Why

The upstream plugin keeps every writer behind one global mutex, awaits network I/O while holding it, has no force-disconnect command, and can retain native sockets across webview reload. A half-open transport can therefore survive JS reset/reload and block unrelated connections.

This is lifecycle hardening, not a claim that it was the proven root cause of Mat's report: Mat was on 0.4.16 before #2060, and the observed trigger aligns with a relay pod bounce.

Validation

• just ci (Hermit Rust 1.95): pass
• Desktop Tauri suite: 1471 passed, 13 ignored
• Desktop JS suite: 3158 passed
• focused native lifecycle tests: EOF cleanup, bounded/idempotent forced shutdown, cross-connection queue isolation, teardown gate ordering
• independent red-team found three blockers; fixed the TS resurrection-prone approach by dropping ordered per-client awaits, held native connect gate through disconnect_all, and added the inlined-plugin ACL/default permission
• generated ACL confirms websocket:default allows connect/send/disconnect/disconnect_all

Not run

• signed/package release build: requires real bundled sidecar artifacts; compile, clippy, unit, frontend build, and generated ACL all ran locally

[wesbillman]

No code-level blocker found in the native WebSocket lifecycle implementation. I checked cancellation/gating, bounded queues and shutdown, stale-connection cleanup, frontend IPC compatibility, ACL registration, reload teardown, and the added Rust/JS/E2E coverage.

I’m holding approval because this head (3633663fe) is behind current main and required CI is not green: Desktop E2E Integration is failing in the newer onboarding membership-denial/import flow, while several smoke shards are still running. The failure appears unrelated to this WebSocket diff, so please sync current main and rerun CI; I can approve once the updated head is green.

[wesbillman]

Implementation review is clean. Approving so this can merge after the branch is synced as needed and required CI is green.