fix(csr): move websocket authentication to first frame

[nicklasl]

Summary

• remove the session token from the WebSocket URL
• authenticate with the first client frame and wait for a server acknowledgement before sending recording data
• re-authenticate before flushing buffered data after reconnects
• regenerate the embedded worker and update coverage

Protocol

Client authentication frame:

{"type":"authenticate","token":"<session token>"}

Server acknowledgement:

{"type":"authenticated"}

The compatible backend must be deployed before this SDK change. The backend implementation should continue accepting the legacy session_token query parameter during rollout.

Verification

• yarn test:csr
• yarn workspace @spotify-confidence/csr-common typecheck
• yarn lint:csr
• git diff --check