refactor: extract SessionWebSocketManager from SessionDO (#74)

* refactor: extract SessionWebSocketManager from SessionDO (#27)

Centralizes all Cloudflare WebSocket API usage (ctx.acceptWebSocket,
ctx.getWebSockets, ctx.getTags, ctx.setWebSocketAutoResponse) into a
single testable module. This replaces 5+ inline tag-parsing sites with
a single classify() method and consolidates hibernation recovery,
auth timeout enforcement, and broadcast filtering.

The manager is a registry for ClientInfo, not a factory — the DO builds
ClientInfo with domain knowledge (GitHub avatars, name fallback) and
stores it via setClient/getClient. For hibernation recovery, the manager
returns raw DB mappings; the DO converts them to ClientInfo.

Key changes:
- New SessionWebSocketManager interface + SessionWebSocketManagerImpl
- Atomic acceptAndSetSandboxSocket (accept + replace + set)
- getSandboxSocket reads expected sandbox ID from repository internally
- forEachClientSocket supports "all_clients" and "authenticated_only"
- 46 unit tests with FakeCtx and mock repository
- Net reduction of ~150 lines in durable-object.ts

Phase 1: all broadcasts use "all_clients" mode (behavior-preserving).
Phase 2 (follow-up) will switch to "authenticated_only" with DB-backed
auth check for post-hibernation correctness.

* fix: call enableAutoPingPong once in ensureInitialized, not per subscribe

setWebSocketAutoResponse is a DO-global setting. Calling it on every
subscribe was harmless but redundant. Move to ensureInitialized() so
it runs once per DO instance lifecycle.

Author: ColeMurray