refactor: scope broadcasts to subscribed WebSocket clients

[ColeMurray]

Summary

• Narrow broadcast() audience from all connected clients to only those that have completed the subscribe handshake
• Clients receive full state sync on subscribe, so no data is missed
• Add integration-style test validating the broadcast pattern across authenticated, post-hibernation, unauthenticated, and sandbox sockets

Test plan

• Unit tests pass (326/326)
• Type check passes
• Verify authenticated clients receive real-time updates normally via web UI
• Verify post-hibernation clients continue receiving broadcasts after DO wake

[github-actions]

Terraform Validation Results

Step	Status
Format	⚠️
Init	✅
Validate	✅

Note: Terraform plan was skipped because secrets are not configured. This is expected for external contributors. See docs/GETTING_STARTED.md for setup instructions.

Pushed by: @ColeMurray, Action: pull_request

[greptile-apps]

Greptile Overview

Greptile Summary

Changed the broadcast() method to only send messages to authenticated WebSocket clients (those that have completed the subscribe handshake) instead of all connected clients. This prevents unauthenticated connections from receiving real-time updates before they've been authorized, while still supporting post-hibernation clients that have persisted database mappings.

• Narrows broadcast audience from all_clients to authenticated_only mode
• Added comprehensive integration test validating broadcast behavior across authenticated, post-hibernation, unauthenticated, and sandbox socket types
• No data loss since clients receive full state sync on subscribe