fix: harden WebSocket handling

[ryanfowler]

Summary

• sanitize terminal-bound WebSocket and HTTP output and redact sensitive handshake headers
• bound interactive history, input, buffering, and redraw work while honoring message modes
• complete close handshakes, report abnormal closures, and preserve timeout/proxy semantics
• reject unsupported WebSocket flags and document the historical audit and resulting behavior

Validation

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all-features --lib --bins (885 passed)
• full integration suite with --test-threads=2 (153 passed)