perf: bound container memory within 80MiB and authenticate telemetry socket

[masseselsev]

Closes #27.

What

1. Embedded Container Memory Ceiling (<100MB Budget):

   • Configures GOMEMLIMIT=80MiB and GODEBUG=madvdontneed=1 in the Dockerfile and Go runtime defaults, forcing aggressive page reclamation back to the Linux host kernel/cgroups.
   • Triggers runtime.GC() and debug.FreeOSMemory() immediately after the metric bucket backfill completes.

2. SQLite Connection Pool & Page Cache Bounding:

   • Reduces MaxOpenConns from 10 to 4 and MaxIdleConns from 5 to 2.
   • Reduces _pragma=cache_size from -2000 to -1024 (1MB per connection), eliminating duplicate page cache allocations across connections in the Go heap.

3. Post-Retention WAL Truncation:

   • Executes PRAGMA wal_checkpoint(TRUNCATE) followed by OS memory release when PruneRawMetrics deletes rows, ensuring deleted pages do not inflate cgroup memory-current.

4. Throttled Metric Bucket Writes:

   • Throttles ComposeMetricBuckets to run at most once per 60s (or when crossing a 15-minute grid boundary), reducing heavy SQLite GROUP BY upsert churn by ~83%.

5. WebSocket Authentication Enforcement (ws: /ws/telemetry accepts unauthenticated connections; README claims 1008 rejection #27):

   • Enforces session cookie, Bearer token, or ?token= parameter on /ws/telemetry.
   • Rejects unauthenticated handshakes with WebSocket code 1008 (ClosePolicyViolation) as documented in the README.

Verification

• Backend tests: 6/6 packages passing (including 4 new WebSocket auth tests and retention tests).
• Frontend tests: 37 test suites, 397/397 passing.
• Production bundle: compiled cleanly in 1.42s.
• Identifier sweep: clean of operational data.