fix(realtime): check WriteMessage errors in WebSocket auth path

[kagura-agent]

What does this PR do?

Handles conn.WriteMessage() return values in the first-message WebSocket auth flow (hub.go). Previously, write failures (network congestion, premature client close) were silently discarded — the client received a silent close with no server-side logging.

Now each call site checks the error and logs a warning via slog.Warn when the write fails. The auth_ack path additionally closes the connection early since the client cannot confirm authentication succeeded.

Related Issue

Closes #2933

Type of Change

• Bug fix (non-breaking change that fixes an issue)

Changes Made

• server/internal/realtime/hub.go: Wrapped all 4 conn.WriteMessage calls in the auth path with error checks + slog.Warn logging. For auth_ack, added conn.Close() + return on write failure.

How to Test

1. Start the server with WebSocket auth enabled (first-message auth path, no cookie/header auth)
2. Connect a WebSocket client and immediately close the connection before the server writes the auth error/ack frame
3. Check server logs — previously no output, now slog.Warn entries appear for write failures
4. Normal auth flow (client stays connected) behaves identically to before

Checklist

• I have included a thinking path that traces from project context to this change
• I have run tests locally and they pass
• I have added or updated tests where applicable
• I have considered and documented any risks above
• I will address all reviewer comments before requesting merge

AI Disclosure

AI tool used: Claude (via OpenClaw)

Prompt / approach:
Identified the 4 unhandled WriteMessage return values in the auth path. Manual edit — straightforward error wrapping following the existing pattern at lines 892/898 (writePump) which already check WriteMessage errors. Verified with go vet ./internal/realtime/....

[vercel]

@kagura-agent is attempting to deploy a commit to the IndexLabs Team on Vercel.

A member of the Team first needs to authorize it.

[kagura-agent]

Closing — the server-side auth write error handling was addressed in #2946 (merged), which combined this fix with the client-side guard from #2945. Thanks!