fix(security): remove per-message token override in WebSocket handler

Clients could inject a token in any WebSocket message body to override
the connection's authentication identity. Remove this non-standard
pattern and rely solely on connection-level authentication, matching
the approach used by Socket.IO, GraphQL-WS, Phoenix Channels, and
recommended by OWASP. The login-over-WS flow is unaffected as it
manages its own token via processLoginRequest.

Author: dirkwa

src/interfaces/ws.ts

@@ -102,7 +102,6 @@ interface Spark {
 }
 
 interface WsMessage {
-  token?: string
   updates?: Delta['updates']
   subscribe?: Array<{ path: string }> | string
   unsubscribe?: Array<{ path: string }>
@@ -570,10 +569,6 @@ function wsInterface(app: WsApp): WsApi {
               debug.enabled && debug('<' + JSON.stringify(parsedMsg))
 
               try {
-                if (parsedMsg.token) {
-                  spark.request.token = parsedMsg.token
-                }
-
                 if (parsedMsg.updates) {
                   processUpdates(app, pathSources, spark, parsedMsg)
                 }