feat: Anonymous WebSocket connections with Strategy Pattern

[tomassirio]

Problem

Guest users (not logged in) could not see real-time trip updates in the browser. The WebSocket server required authentication, causing connections to fail for anonymous users.

Solution

Implemented a Strategy Pattern for WebSocket authentication that supports both authenticated and anonymous connections with proper security controls.

Architecture

Strategy Pattern Components

1. WebSocketAuthenticationStrategy - Interface defining authentication contract
2. AuthenticationResult - Immutable result object with userId, auth status, and anonymous flag
3. TokenAuthenticationStrategy - JWT token validation for authenticated users
4. AnonymousAuthenticationStrategy - Fallback for guest users
5. WebSocketAuthenticationService - Chain of responsibility orchestrator
6. WebSocketAuthenticationConfig - Spring configuration defining strategy order

Security Features

• ✅ Rate Limiting: Anonymous users limited to 10 topic subscriptions
• ✅ Audit Logging: Tracks authenticated vs anonymous connections with remote address
• ✅ Graceful Degradation: Invalid tokens fall back to anonymous mode
• ✅ Resource Protection: Prevents subscription abuse
• ✅ Read-Only Access: Anonymous users can only subscribe, not send commands

Strategy Order

1. TokenAuthenticationStrategy (priority 1) - Tries JWT authentication first
2. AnonymousAuthenticationStrategy (fallback) - Allows anonymous if no token

Code Quality

• SOLID Principles: Single Responsibility, Open/Closed, Dependency Inversion
• Design Patterns: Strategy + Chain of Responsibility
• Extensibility: Easy to add OAuth, API keys, or other auth methods
• Testability: Each strategy independently testable
• Clean Architecture: Clear separation of concerns

Changes

• WebSocketConnectionHandler.java - Uses strategy service instead of direct JWT validation
• WebSocketSessionManager.java - Adds subscription counting and rate limiting
• auth/WebSocketAuthenticationStrategy.java - Strategy interface
• auth/AuthenticationResult.java - Immutable result object
• auth/TokenAuthenticationStrategy.java - JWT validation strategy
• auth/AnonymousAuthenticationStrategy.java - Anonymous fallback strategy
• auth/WebSocketAuthenticationService.java - Strategy orchestrator
• auth/WebSocketAuthenticationConfig.java - Spring bean configuration

Testing

# Compile and install
mvn clean install -DskipTests

# Verify compilation
mvn clean compile

Deployment

The frontend PR (#192) must be merged and deployed alongside this change.