feat(wsclient): add Hostlink WebSocket client with signed upgrade, reconnect, and feature flag

[iAziz786]

Summary

Add Hostlink WebSocket client infrastructure with signed upgrade headers, reconnect backoff, ping/pong handling, and initial agent.hello handshake. This chunk does not execute websocket-delivered tasks yet.

Changes

Config

• WebSocketEnabled(), WebSocketURL(), WebSocketReconnectMin(), WebSocketReconnectMax(), WebSocketPingInterval() helpers in config/appconf
• URL derivation from SH_CONTROL_PLANE_URL (http→ws, https→wss, appends /api/v1/agents/ws)
• Env vars: HOSTLINK_WS_ENABLED, HOSTLINK_WS_URL, HOSTLINK_WS_RECONNECT_MIN, HOSTLINK_WS_RECONNECT_MAX, HOSTLINK_WS_PING_INTERVAL

Signer

• SignHeaders() method on RequestSigner returns http.Header with X-Agent-ID, X-Timestamp, X-Nonce, X-Signature
• Existing SignRequest() refactored to delegate to SignHeaders()

WebSocket Client (app/services/wsclient)

• Dialer/Conn interface seam for testability
• Concrete implementation via github.com/gorilla/websocket with signed upgrade
• Sends agent.hello immediately on connect; marks active only after agent.hello_ack
• Handles inbound ack and error messages; unsupported types trigger reconnect
• Infinite reconnect with jittered exponential backoff (ReconnectMin/ReconnectMax)
• Ping/pong keepalive via WriteControl(PingMessage, ...)
• Context cancellation closes socket cleanly

Startup Wiring (main.go)

• Feature-flagged start via startWebSocketClientIfEnabled called after registration
• Client starts asynchronously without blocking polling, heartbeat, metrics, or self-update jobs
• Missing agent state or private key logs error but does not crash

Tests

• Config tests: URL derivation, feature flag parsing, duration settings
• Signer tests: SignHeaders returns valid signed headers with verifiable signatures
• Client tests: agent.hello sent immediately, active on agent.hello_ack, ack recorded, error triggers reconnect, server close reconnects, ping failure reconnects
• Startup tests: disabled no-ops, enabled starts async, constructor failure does not block
• Existing tests continue to pass across config/appconf, requestsigner, taskfetcher, taskreporter

Dependency

• Added github.com/gorilla/websocket v1.5.3