JwtHandshakeInterceptor

WebSocket handshake interceptor that optionally authenticates the upgrading connection using a JWT.

How it works:

• Looks for an access token in either the Authorization: Bearer header or token query parameter on the WS URL.

• If present and not blacklisted, validates it and attaches the ProductUser to the WebSocket attributes.

• Does not enforce authentication; handlers may still allow anonymous connections and authorize per-message.

Relation to DPoP:

• DPoP applies to HTTP requests, not WebSocket frames. We allow tokens issued via HTTP (DPoP-bound) to be presented at upgrade using the Bearer scheme. Binding is enforced on HTTP APIs; WS connections should close or require re-auth when the token expires.