fix: keep interactive controls live without WebSockets

[sppidy]

Summary

• preserve WebSocket as the primary interactive control transport
• fall back to an authenticated, CSRF-protected HTTPS long-poll tunnel when upgrades are blocked
• share ACL, RBAC, approval, ownership, and recording enforcement across both transports
• add browser journey coverage for an executable terminal with WebSockets forcibly blocked

Validation

• cargo test -p server --locked (67 passed)
• cargo clippy -p server --all-targets --locked -- -D warnings
• npm test (98 passed)
• npm run typecheck
• npm run lint (0 errors; 63 existing warnings)
• npm run build
• local container journey unavailable because this host has no Docker Compose provider; production browser verification will force WebSockets off after deployment

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.