fix: WebSocket 403 — register WebSocket routes without require_active_plugin dependency

WebSocket routes were getting require_active_plugin dependency applied
via include_router(dependencies=[...]) which caused 403 Forbidden
before the WebSocket upgrade could happen.

Fix: Split router into HTTP routes (with dependency) and WebSocket routes
(registered separately without the active-plugin check). WebSocket auth
is handled inside the endpoint itself via session cookie verification.

app/main.py

@@ -438,16 +438,28 @@ def create_app() -> FastAPI:
                             # Wrap each HTTP route handler with plugin error isolation
                             # Skip WebSocket routes — the wrapper breaks WS parameter
                             # resolution and returns JSONResponse instead of WS close.
+                            from starlette.routing import WebSocketRoute
+                            http_routes = []
+                            ws_routes = []
                             for route in router.routes:
                                 if isinstance(route, WebSocketRoute):
-                                    continue
+                                    ws_routes.append(route)
-                                if hasattr(route, 'endpoint'):
+                                else:
-                                    route.endpoint = wrap_plugin_route(route.endpoint)
+                                    if hasattr(route, 'endpoint'):
-                            # Add active-plugin check as a router-level dependency
+                                        route.endpoint = wrap_plugin_route(route.endpoint)
+                                    http_routes.append(route)
+                            # Register HTTP routes with active-plugin check
+                            router.routes = http_routes
                             app.include_router(
                                 router,
                                 dependencies=[Depends(require_active_plugin(plugin_name))],
                             )
+                            # Register WebSocket routes WITHOUT active-plugin check
+                            # (WebSocket auth is handled inside the endpoint itself)
+                            if ws_routes:
+                                ws_router = APIRouter()
+                                ws_router.routes = ws_routes
+                                app.include_router(ws_router)
                         except Exception as exc:
                             logger.error(f"Failed to register route {route_def.module}.{route_def.router_attr}: {exc}")
                     break