feat: Phase 7.2 — WS 连接 JWT 认证

- 从 ?token=xxx 查询参数提取 access_token
- 校验失败返回 401（missing token / invalid token）
- 校验成功后将 userID 用于创建会话
- 更新现有测试：setupTestServer 自动生成有效 token

backend/internal/ws/handler.go

@@ -107,6 +107,21 @@ func ServeWS(sessionMgr session.Manager, orch orchestrator.Orchestrator, cfg *co
 
 func serveWS(c *gin.Context, sessionMgr session.Manager, orch orchestrator.Orchestrator,
 	upgrader websocket.Upgrader, heartbeatInterval, heartbeatTimeout time.Duration, version string, maxHistory int, tokenMgr *auth.TokenManager) {
+
+	// --- JWT 认证（upgrade 前完成，失败直接返回 HTTP 错误） ---
+	token := c.Query("token")
+	if token == "" {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "missing token"})
+		return
+	}
+	claims, err := tokenMgr.ValidateAccess(token)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+		return
+	}
+	userID := claims.UserID
+	username := claims.Username
+
 	conn, err := upgrader.Upgrade(c.Writer, c.Request, nil)
 	if err != nil {
 		logger.Log.Errorw("websocket upgrade failed", "error", err)
@@ -115,7 +130,7 @@ func serveWS(c *gin.Context, sessionMgr session.Manager, orch orchestrator.Orche
 	defer conn.Close()
 
 	// 创建会话
-	sessionID, err := sessionMgr.Create(context.Background(), "", models.DefaultConfig())
+	sessionID, err := sessionMgr.Create(context.Background(), userID, models.DefaultConfig())
 	if err != nil {
 		logger.Log.Errorw("create session failed", "error", err)
 		return
@@ -135,7 +150,7 @@ func serveWS(c *gin.Context, sessionMgr session.Manager, orch orchestrator.Orche
 		SessionID:     sessionID,
 		ServerVersion: version,
 	})
-	logger.Log.Infow("client connected", "session", sessionID)
+	logger.Log.Infow("client connected", "session", sessionID, "user_id", userID, "username", username)
 
 	// 心跳检测
 	lastPong := time.Now()