Add experimental plugin WebSocket routes in the HTTP route namespace

[SawyerHood]

Stack layer 2 (Codex pool track). Prerequisite: #3053 below it. Core-only: adds plugin WebSocket routes so a provider pool can terminate Codex's WebSocket-first transport at the hub.

Human comments

What was wrong

Plugin HTTP routes had no WebSocket upgrade surface. Codex derives its WebSocket URL from the configured HTTP base URL and tries the Responses WebSocket protocol first, so an Account Pool proxy mounted in a plugin's existing /http/ namespace could serve HTTP but could not accept the corresponding upgrade. Codex therefore had to wait through failed WebSocket attempts before falling back to HTTP SSE.

What changed

• Added bb.http.experimental_websocket(path, handler, opts) and its experimental socket, context, handler, and lifecycle types.
• Mounted exact-path upgrades in the existing /api/v1/plugins/<id>/http/ namespace while preserving ordinary HTTP handling on the same path.
• Applied the existing local, token, and none auth modes to upgrade requests, including header and query-token authentication.
• Isolated connection and event callbacks through the plugin invocation boundary, serialized async callbacks per socket, normalized binary frames to Uint8Array, and closed sockets with code 1012 when their plugin generation reloads or is disabled.
• Added fake-host registration and socket-driving support, public surface/audit entries, Plugin Guide references, and bumped the Plugin SDK to 0.4.46.

There is no host-daemon wire contract change, so HOST_DAEMON_PROTOCOL_VERSION does not need a bump. The existing machine-auth proxy already forwards authenticated WebSocket upgrades and retains its focused regression coverage.

How you verified

The new server and fake-host regressions fail on origin/main because the WebSocket API, registry, dispatch, and test driver do not exist there. They pass on this branch and cover exact-path upgrade dispatch, plain-GET behavior, HTTP/WebSocket coexistence, all auth modes, text and binary frames, callback failure isolation, and code-1012 reload shutdown.

• pnpm exec turbo run typecheck test --filter=@bb/server --filter=@get-bb/plugin-sdk --filter=@bb/plugin-api-map --continue — 13/13 tasks passed; SDK 232 tests, API map 72 tests, server 2,209 tests; all typechecks passed.
• pnpm exec turbo run test typecheck --filter=@get-bb/plugin-sdk --filter=@bb/plugin-api-map --filter=@bb/app --filter=bb-plugin-plugin-api-docs --continue — 11/11 tasks passed; app 3,872 tests passed and 4 skipped.
• pnpm exec turbo run test --filter=@bb/host-daemon -- --run src/machine-auth-proxy.test.ts — 8/8 tests passed, including WebSocket upgrade forwarding with machine authentication.
• bb plugin build plugins/plugin-api-docs — production build passed.
• node .github/workflows/check-plugin-sdk-version.mjs — confirmed the public surface changed with a version bump.
• Live dev app: installed a throwaway plugin with auth: "none", connected to /api/v1/plugins/websocket-e2e/http/v1/echo, and echoed alpha, beta, and binary [0, 127, 255] in order.

Tracks BB-93 (layer A).

AGENT GENERATED