y-websocket JWT認証対応（クライアント送信・auth Docker）

[NishikawaKoharu]

Purpose

Send the OSF-issued JWT from the Milkdown wiki editor to y-websocket, and provide an authenticated y-websocket Docker entrypoint that validates the token.
This is the frontend/infra side of securing collaborative wiki editing WebSocket connections.

Changes

• Update wikiPageMilkdown.js to pass yWebsocketToken as params.token when creating the WebsocketProvider
• Add docker/y-websocket-auth/ (Dockerfile, auth.cjs, server-wrapper.cjs) for JWT-authenticated y-websocket deployments

QA Notes

• Does this change require a data migration? If so, what data will we migrate?
  • No
• What is the level of risk?
  • Medium (affects collaborative editing connection auth)
  • Any permissions code touched?
    • No. Permission checks remain on the OSF side; this change only forwards and validates tokens
  • Is this an additive or subtractive change, other?
    • Additive. If the token is empty, the client connects without auth params (backward compatible)
• How can QA verify? (Through UI, API, AdminApp or AdminAdminApp?)
  • UI: With OSF JWT issuance enabled, confirm wiki collaborative editing can connect
  • Deploy the auth image with Y_WEBSOCKET_SECRET and confirm missing/invalid/expired tokens are rejected
    (Y_WEBSOCKET_ALLOWED_ORIGINS is optional hardening and not required for this fix)
  • Note: production requires rebuilding webpack artifacts (wiki-edit-page.js) and reflecting them into OSF as usual
• What features or workflows might this change impact?
  • Wiki Milkdown collaborative editing
• How will this impact performance?
  • Negligible: JWT validation only at WebSocket upgrade time

Documentation

• Document switching y-websocket to the auth image and required env var Y_WEBSOCKET_SECRET
  (Y_WEBSOCKET_ALLOWED_ORIGINS is optional)
• No API documentation updates required

Side Effects

• Enabling the auth image with a secret before the updated frontend is deployed may cause 401s for older clients
• Roll out together with OSF token issuance and the authenticated y-websocket deployment

Related PRs

Bitbucket

• deploy: https://bitbucket.org/osf_japan/r-deploy/pull-requests/84
• R-helm-charts: https://bitbucket.org/osf_japan/r-helm-charts/pull-requests/20

GitHub

• RDM-osf.io: Feature/y websocket jwt auth RDM-osf.io#797

Ticket

https://redmine.devops.rcos.nii.ac.jp/issues/60810

[yacchin1205]

いくつか変更した方が良い点を見つけております。GitHubではなくチケットに記載したいので許可をいただけますと幸いです。