Add WebSocket auth for Daemon↔Policy transport (mTLS/token)

[Slymeofthemonth]

The WS transport between daemon and policy server is currently unauthenticated plaintext. Need to add either mTLS with pinned certs or token-based auth before production use.

Ref: PR #14, docs/threshold-signing-spec.md