[BUG] [v0.0.7] websocket Auth message marks session authenticated with hardcoded user id #190

Summary

WebSocket auth handling is effectively hardcoded and unauthenticated in-place.

In handle_text_message, receiving WsClientMessage::Auth { token: _ } sets:

• ctx.authenticated = true
• ctx.user_id = Some("user123".to_string())
  without validating the token at all.

Evidence

• src/cortex-app-server/src/websocket.rs:182-185

Impact

• Any client can pretend to be an authenticated user and create a CLI session with a fixed identity.
• If admin/user-restriction logic later relies on ctx.user_id, this becomes a consistent auth bypass.
• The placeholder behavior is reachable because websocket routes are mounted without auth middleware as well.

Reproduction

1. Open websocket connection to /api/v1/ws.
2. Send JSON message: { "type": "auth", "token": "anything" }.
3. Observe an auth_result success response and ctx.authenticated == true.

Expected

Authenticate and verify JWT/API-key material before marking context authenticated.

Suggested Fix

• Parse and validate token using shared auth logic (auth::auth_middleware / JWT validation).
• Reject invalid or missing tokens for websocket auth mode.
• Consider rotating to server-issued connection credentials instead of static placeholder values.