refactor(gateway): make the resolved-auth getter the only WS auth input (#122310)

`attachGatewayWsConnectionHandler` took both a `resolvedAuth` snapshot and an
optional `getResolvedAuth`, and used the snapshot for nothing except defaulting
the getter. Every production caller already passed the getter, so the snapshot
was a second signal for a fact that rotates on config reload — the exact shape
that goes stale as sibling paths evolve.

Collapse it to one required getter and drop the argument from
`server-ws-runtime.ts` and `server-startup-finish.ts`. That also puts
`server-startup-finish.ts` back under the 700-line cap, which the preflight
change's `getResolvedAuth` pass-through had pushed one line over; the file was
already sitting exactly at the limit on `main`.

src/gateway/server-startup-finish.ts

@@ -110,7 +110,6 @@ export async function finishGatewayStartup(params: {
     workerLiveEvents,
     earlyRuntime,
     cfgAtStart,
-    resolvedAuth,
     preauthConnectionBudget,
     releaseStartupAccountStarts,
     cronReconciliation,
@@ -151,7 +150,6 @@ export async function finishGatewayStartup(params: {
           listPluginNodeCapabilities(pluginRuntime.registry),
           isCoreCanvasHostEnabled(getRuntimeConfig()),
         ),
-      resolvedAuth,
       getResolvedAuth,
       getRequiredSharedGatewaySessionGeneration: () =>
         getRequiredSharedGatewaySessionGeneration(sharedGatewaySessionGenerationState),

src/gateway/server-ws-runtime.ts

@@ -26,7 +26,6 @@ export function attachGatewayWsHandlers(params: GatewayWsRuntimeParams) {
     gatewayHost: params.gatewayHost,
     pluginSurfaceScheme: params.pluginSurfaceScheme,
     getPluginNodeCapabilities: params.getPluginNodeCapabilities,
-    resolvedAuth: params.resolvedAuth,
     getResolvedAuth: params.getResolvedAuth,
     getRequiredSharedGatewaySessionGeneration: params.getRequiredSharedGatewaySessionGeneration,
     rateLimiter: params.rateLimiter,

src/gateway/server/ws-connection.startup.test.ts

@@ -37,7 +37,7 @@ describe("attachGatewayWsConnectionHandler startup readiness", () => {
       clients,
       socket,
       options: {
-        resolvedAuth: { mode: "token", allowTailscale: false, token: "test-token" },
+        getResolvedAuth: () => ({ mode: "token", allowTailscale: false, token: "test-token" }),
         buildRequestContext: () => createGatewayWsTestRequestContext() as never,
       },
     });
@@ -116,7 +116,7 @@ describe("attachGatewayWsConnectionHandler startup readiness", () => {
         attach: attachGatewayWsConnectionHandler,
         socket,
         options: {
-          resolvedAuth: { mode: "none", allowTailscale: false },
+          getResolvedAuth: () => ({ mode: "none", allowTailscale: false }),
           isStartupPending: () => true,
           logWsControl: logWsControl as never,
           buildRequestContext: () => createGatewayWsTestRequestContext() as never,

src/gateway/server/ws-connection.test-helpers.ts

@@ -106,7 +106,7 @@ export function attachGatewayWsForTest(params: {
     clients: clients as never,
     preauthConnectionBudget: { release: vi.fn() } as never,
     port: 19001,
-    resolvedAuth: createResolvedGatewayTokenAuth("token"),
+    getResolvedAuth: () => createResolvedGatewayTokenAuth("token"),
     preauthHandshakeTimeoutMs: 60_000,
     gatewayMethods: [],
     events: [],

src/gateway/server/ws-connection.test.ts

@@ -159,7 +159,6 @@ describe("attachGatewayWsConnectionHandler", () => {
 
     const { passed } = await connectTestWs({
       options: {
-        resolvedAuth: initialAuth,
         getResolvedAuth: () => currentAuth,
       },
     });

src/gateway/server/ws-connection.ts

@@ -160,8 +160,12 @@ type GatewayWsSharedHandlerParams = {
   gatewayHost?: string;
   pluginSurfaceScheme?: "http" | "https";
   getPluginNodeCapabilities?: () => PluginNodeCapabilitySurface[];
-  resolvedAuth: ResolvedGatewayAuth;
-  getResolvedAuth?: () => ResolvedGatewayAuth;
+  /**
+   * Auth is read per connection, not per process: a reload can rotate it while
+   * this handler stays attached. One getter keeps that the only source, so no
+   * caller can hand over a snapshot that silently outlives the config it came from.
+   */
+  getResolvedAuth: () => ResolvedGatewayAuth;
   getRequiredSharedGatewaySessionGeneration?: () => string | undefined;
   /** Optional rate limiter for auth brute-force protection. */
   rateLimiter?: AuthRateLimiter;
@@ -240,8 +244,7 @@ export function attachGatewayWsConnectionHandler(params: AttachGatewayWsConnecti
     port,
     pluginSurfaceScheme,
     getPluginNodeCapabilities,
-    resolvedAuth,
-    getResolvedAuth = () => resolvedAuth,
+    getResolvedAuth,
     getRequiredSharedGatewaySessionGeneration = () =>
       resolveSharedGatewaySessionGeneration(
         getResolvedAuth(),