fix(websocket): enforce maxPayload and bound incoming frame sizes (closes #929)

[mopxam-art]

Why

WebSocket servers (/ws and /ws/events) were instantiated without an explicit maxPayload, defaulting to ws library's 100 MiB limit. In addition, handleMessage lacked raw byte length guards before JSON parsing incoming payloads, allowing oversized frames to allocate unbounded memory.

What

• Configured explicit maxPayload: WS_MAX_PAYLOAD_BYTES (64 KiB default, configurable via WS_MAX_PAYLOAD_BYTES) on both /ws and /ws/events WebSocketServer instances in src/lib/websocket.ts.
• Added pre-parse byte length verification in handleMessage that terminates oversized frames with close code 1009 payload too large before parsing JSON.
• Added support for safe buffer/view text decoding in handleMessage.
• Documented WS_MAX_PAYLOAD_BYTES and close code 1009 in API.md.
• Added comprehensive unit and integration test suite covering boundary values, varied payload formats, isolation, and unmount cleanup (src/__tests__/websocket-max-payload.test.ts).

Verified

• All unit tests pass (jest src/__tests__/websocket-max-payload.test.ts, 114 tests pass).
• Full WebSocket test suite passes (131 tests pass).
• TypeScript typecheck (npm run typecheck) and linter (npm run lint) clean with 0 errors.
• Production build (npm run build) succeeds cleanly.

Closes #929