fix: WebSocket 403 — per-route require_active_plugin instead of router-level

Router-level dependencies=[Depends(require_active_plugin)] was applied
to ALL routes including WebSocket. Now adding the dependency per-HTTP-route
only, WebSocket routes are skipped entirely.

app/main.py

@@ -436,20 +436,21 @@ def create_app() -> FastAPI:
                             router_module = importlib.import_module(route_def.module)
                             router = getattr(router_module, route_def.router_attr)
                             # Wrap each HTTP route handler with plugin error isolation
-                            # Skip WebSocket routes — the wrapper breaks WS parameter
-                            # resolution and returns JSONResponse instead of WS close.
+                            # and add active-plugin check per-route (not router-level)
+                            # so WebSocket routes are NOT affected.
                             from starlette.routing import WebSocketRoute
+                            from fastapi import APIRouter as _AR
+                            plugin_dep = Depends(require_active_plugin(plugin_name))
                             for route in router.routes:
                                 if isinstance(route, WebSocketRoute):
-                                    continue
+                                    continue  # WebSocket: no wrap, no plugin check
                                 if hasattr(route, 'endpoint'):
                                     route.endpoint = wrap_plugin_route(route.endpoint)
-                            # Add active-plugin check as a router-level dependency
-                            # (require_active_plugin skips WebSocket requests internally)
-                            app.include_router(
-                                router,
-                                dependencies=[Depends(require_active_plugin(plugin_name))],
-                            )
+                                # Add require_active_plugin to each HTTP route's dependencies
+                                if not hasattr(route, 'dependencies'):
+                                    route.dependencies = []
+                                route.dependencies.append(plugin_dep)
+                            app.include_router(router)
                         except Exception as exc:
                             logger.error(f"Failed to register route {route_def.module}.{route_def.router_attr}: {exc}")
                     break