fix(server): gate WebSocket on ban and rate limit, map errors to status

The WebSocket route skipped the ban and rate-limit checks that the HTTP
path enforced, and returned errors set no custom status, so circuit-open
became HTTP 500. The route now runs the same ban and rate-limit checks
before the upgrade, and a custom error handler maps errors to the
correct status, including 503 for circuit-open. The API and admin
listeners honour the BIND_ADDRESS option.

admin_dashboard_test.go

@@ -161,7 +161,6 @@ func TestAdminDashboard_GetCircuitBreakerStatus(t *testing.T) {
 	cfg = &config{
 		Logger: logger,
 		CircuitBreaker: struct {
-			EndpointConfigs       map[string]*EndpointCBConfig
 			ExcludedStatusCodes   []int
 			MaxFailures           int
 			FailureRatio          float64