New /api/v1/ws endpoint providing bidirectional WebSocket alongside the existing SSE (/api/v1/events/stream). Shares the same event broadcasts (resource alerts, health status, incidents, updates, dependencies, auto-restart, drift, SSL, DNS propagation). Features: - Auth-gated in production (session cookie or token query param) - Subscribe/unsubscribe event filtering - Ping/pong heartbeat + dead connection sweep - Clean shutdown removes all EventEmitter listeners - Exact path matching (no broad includes) - Fixed unsubscribe semantics (empty set = receive nothing) 8 WS tests, 1560 total tests pass.