actions/register_ws_endpoint.ts

Composed WebSocket endpoint registration — the primitive create_app_server mounts each ws_endpoints entry with. An app assembled by create_app_server declares its endpoints there rather than calling this, and gets the shared action rate limiters, the origin default, the surface entry, and the audit guard with them.

Wraps the standard upgrade stack:

1. verify_request_source(allowed_origins) — reject disallowed origins before the upgrade handshake runs.
2. require_auth — reject unauthenticated upgrades.
3. require_token_scope('surface:ws_upgrade') — rule 3: a narrowed token cannot hold a socket. Mounted here, ahead of the role guard, so a narrowed token is told about its scope rather than about a role it also lacks. register_action_ws repeats the check on its own route chain, which is what covers consumers mounting it directly; the earlier answer wins when both are wired.
4. Authorization phase — resolve the acting actor against the authenticated account plus an optional ?acting=<uuid> query string, and build the RequestContext that per-message dispatch reads. Multi-actor accounts must supply ?acting to pick a persona; single-actor accounts work without it.
5. Optional require_role(required_roles) — for endpoints gated to a non-empty any-of set of roles.

Then delegates to register_action_ws for per-message JSON-RPC dispatch.