server: authorize voice websocket bind

[yisding]

Problem

VoiceServer's raw-WebSocket listener relied on an earlier process-level guard rather than carrying authorization at the websockets.serve capability boundary. A future startup refactor could therefore separate validation from the socket-opening backend call.

Change

• retain VoiceServer's existing early guard and HTTP-first startup ordering
• invoke websockets.serve only through the deferred binder passed to authorized_bind
• preserve backend arguments, return values, exception identity, and the existing HTTP rollback path
• add focused proofs that rejected authorization never calls the backend and backend errors propagate unchanged
• reclassify only this listener in the bind inventory (6 authorized, 3 pending)

Test evidence

• env UV_FROZEN=1 uv run pytest tests/server/test_voice_server_lifecycle.py tests/server/test_auth.py tests/ratchets/test_bind_inventory.py -q — 72 passed, 4 skipped
• env UV_FROZEN=1 uv run pytest tests/config/test_secret_reprs.py tests/server/test_auth.py tests/transports/test_webrtc_auth_browser_playground.py -q — 74 passed, 3 skipped
• env UV_FROZEN=1 just check — pre-commit and mypy passed; 8,611 passed, 309 skipped

Stacked on #950.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 54bc1908-3a6a-431a-be76-fbc18b5a5638

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}