[BE-94] Authenticate and authorize the WebSocket gateway

[yusuftomilola]

Overview

@nestjs/websockets, @nestjs/platform-socket.io, and socket.io are installed and notifications are expected to push in real time. WebSocket connections need the same authentication and authorization guarantees as HTTP routes — an unauthenticated socket subscribing to another member's notification room would be a serious leak.

Tasks

• Verify the JWT during the socket handshake and reject unauthenticated connections.
• Join each socket to a user-scoped room (user:{id}); never broadcast personal notifications globally.
• Authorize room subscriptions — a client may only join rooms it owns (admin rooms require the admin role).
• Handle token expiry mid-connection: disconnect or require re-auth.
• Add connection rate limiting and a max-connections-per-user cap.
• Add tests for handshake rejection and cross-user room access denial.

Acceptance Criteria

• A socket without a valid token cannot connect.
• User A cannot subscribe to user B's room (covered by a test).
• An expired token terminates the connection.

Notes for Contributors

Comment below to be assigned.