Protocol hardening (audit, medium): inbound zod validation, unknown-type default, WS payload/backpressure limits

[saucam]

Verified medium protocol-layer hardening items from the audit.

• No schema validation of inbound messages — server.ts:324 casts raw JSON.parse output as ClientMessage; protocol/types.ts has no zod. Missing fields throw deep in handlers (caught into response.error, but no validation layer). Robustness/DoS, not auth bypass (auth + scope checks run first). Fix: zod discriminated-union for ClientMessage; safeParse at server.ts:324, return invalid_request on failure.
• Unknown msg.type hangs the client's request — session-manager.ts:186-237 switch has no default, so handle() returns undefined → ws.send(undefined) (server.ts:337) sends nothing → the client's pending promise for that id never resolves until its 30s timeout. Fix: default: arm returning {type:"response.error", requestId: msg.id ?? "", code:"invalid_request"} (subsumed by the zod fix above).
• No WS payload cap / no broadcast backpressure — server.ts:269 (no maxPayloadLength), session.ts:2454 #broadcastRaw ignores ws.send's backpressure return (Bun returns -1, never throws) so the catch-and-prune is effectively dead; a slow/stalled client accrues unbounded server-side buffer and is never pruned. Fix: set maxPayloadLength + a backpressure policy; in #broadcastRaw inspect ws.bufferedAmount/send result and detach past a threshold.

(Telegram frontend low-sev polish — stale-client pruning on permanent send failure telegram/index.ts:934, and lengthening the 8-hex approval-prefix key telegram/index.ts:762 — tracked here too; negligible-probability but no upside.)

[saucam]

Addressed in 48c2c30 (main): handle() default case (unknown/malformed type now returns response.error/invalid_request instead of hanging the client's request), plus WS maxPayloadLength (16MB) + backpressureLimit + closeOnBackpressureLimit. Still open: full per-variant zod discriminated-union validation of ClientMessage — deferred to avoid a too-strict schema rejecting valid messages from the web/Rust/Telegram clients before it's verified against all three.