- Add matrix_ws_token setting to config.py for token-based WS auth
- Add _authenticate_ws() helper to validate tokens in world.py
- Support token via query param (?token=) or first message ({type: auth})
- Close connection with code 4001 on invalid/missing token
- Send connection_ack message after successful authentication
- Auth disabled when matrix_ws_token is empty (dev mode)
- Add comprehensive tests for WS auth scenarios
Fixes#682