feat: add bounded WebSocket server support

[MikiEEE]

Summary

• add optional wsproto-backed RFC 6455 WebSocket serving over HTTP/1.1 Upgrade
• add a separate static WebSocket route table that can coexist with ordinary GET routes
• validate method/version/Host/Upgrade/Connection/key/origin/subprotocol boundaries before 101
• support text, binary, fragmentation, Ping/Pong, peer/server Close, accept and HTTP rejection
• keep all socket I/O, task scheduling, deadlines, and shutdown on SmallOS/kernel abstractions
• add bounded frame/message/inbox/outbox/fragment/deadline resource policy
• add SmallOS-client and wsproto loopback interoperability, HTTP fairness, malformed-frame, deadline, and cleanup coverage
• add a runnable echo example plus comprehensive README and multipage public guide

Review remediation

Independent review found and closed:

• competing accept/reject decisions during blocked handshake writes
• fast or mismatched Pong deadline races
• invalid subprotocol tokens and unsupported extension negotiation
• unbounded zero-length fragment metadata
• backpressured writes escaping send/close deadlines
• idle timeout failing to cancel sleeping/adapter-waiting handlers
• swallowed KeyboardInterrupt/SystemExit
• reflected internal codec details and incomplete Close accounting
• inaccurate example subprotocol and closure documentation

Final gates:

• critic reviewer: PASS
• adversarial reviewer: PASS
• documentation critic: PASS

Validation

Against canonical SmallOS b3b0e17fc518d80f08d9e9b440bfe929f69c6d0b, wsproto 1.2, and the optional regex extra:

• full extras suite: 145/145 passed
• no-WebSocket-extra suite: 145 passed with expected optional skips
• focused WebSocket suite: 23/23 passed unrestricted
• documentation links/pages/Python fences: passed
• SmallOS WebSocket client and wsproto loopback interoperability: passed
• adapter demo, wheel import smoke, compile, diff, conflict, and forbidden-import checks: passed

The local host is Python 3.9.6 while metadata requires Python 3.10+, so installed-wheel smoke used --ignore-requires-python only for that local mismatch. Independent browser/CLI and Autobahn conformance remain release-hardening gates.

Dependencies and deferred scope

This PR targets develop and logically depends on PRs #4–#6. Until those merge, GitHub's diff includes their shared routing, kernel-transport, and lifecycle foundations.

TLS/WSS, compression, and RFC 8441 WebSockets over HTTP/2 remain explicitly deferred.