Feature/y websocket jwt auth

[NishikawaKoharu]

Purpose

Issue signed JWTs for y-websocket connections used by Wiki collaborative editing, so only users with write permission can authenticate to the WebSocket endpoint.
This is a security hardening change to prevent unauthenticated y-websocket access.

Changes

• Add Y_WEBSOCKET_SECRET, Y_WEBSOCKET_JWT_ALGORITHM, and Y_WEBSOCKET_TOKEN_TTL settings
• Add generate_y_websocket_token() to issue JWTs for editable wiki pages
• Expose yWebsocketToken to the edit page via edit.mako / contextVars
• Add tests covering token issuance for editors and non-visibility for users without write permission

QA Notes

• Does this change require a data migration? If so, what data will we migrate?
  • No
• What is the level of risk?
  • Medium (authentication-related; token issuance follows existing wiki write permission checks)
  • Any permissions code touched?
    • Yes, indirectly: tokens are issued only when the user can edit the wiki. Existing permission logic is reused; permission rules themselves are unchanged
  • Is this an additive or subtractive change, other?
    • Additive. If Y_WEBSOCKET_SECRET is unset, the token remains an empty string (backward compatible)
• How can QA verify? (Through UI, API, AdminApp or AdminAdminApp?)
  • UI: Open a wiki edit page as a user with write permission and confirm yWebsocketToken is present in page context
  • UI: Open the same page without write permission and confirm no usable token is exposed
  • With Y_WEBSOCKET_SECRET configured, verify collaborative editing still works together with the wiki-frontend client change and the authenticated y-websocket image
• What features or workflows might this change impact?
  • Wiki Milkdown collaborative editing (y-websocket)
• How will this impact performance?
  • Negligible: one JWT is generated per editable wiki page render

Documentation

• Deployment docs should mention Y_WEBSOCKET_SECRET (and optionally Y_WEBSOCKET_TOKEN_TTL)
• No API versioning / developer.osf.io updates required

Side Effects

• If y-websocket auth is enabled with a secret before OSF and the frontend are deployed, existing clients may fail to connect
• Coordinate rollout with RDM-wiki-frontend and the y-websocket auth image

Related PRs

Bitbucket

• deploy: https://bitbucket.org/osf_japan/r-deploy/pull-requests/84
• R-helm-charts: https://bitbucket.org/osf_japan/r-helm-charts/pull-requests/20

GitHub

• RDM-wiki-frontend: y-websocket JWT認証対応（クライアント送信・auth Docker） RDM-wiki-frontend#15

Ticket

https://redmine.devops.rcos.nii.ac.jp/issues/60810

[yacchin1205]

いくつか変更した方が良い点を見つけております。GitHubではなくチケットに記載したいので許可をいただけますと幸いです。