Issue Ws Ticket

Exchange the caller’s session (verified via the normal HttpOnly-cookie bearer-token flow) for a 60-second JWT scoped to opening the WebSocket below.

The main access token is deliberately HttpOnly and unreadable by client JS, so it can never be the token query param a browser WebSocket handshake needs. This endpoint is the standard fix: only a short-lived ticket - not the real session token - is ever exposed to JS, so a stolen ticket is useless a minute later.