Scope tailscale tokenless auth to websocket

Editor assessment

This commit patches CVE-2026-32045. The subject `fix(gateway): scope tailscale tokenless auth to websocket` is specific and technically literate: it names the authentication mode, the transport it is now limited to, and the gateway scope is correct. The type matches a security narrowing. No body is included, so the reader is not told what non-websocket path was previously accepted or whether existing deployments break, which is the one detail worth adding. Style is otherwise excellent, with no punctuation issues or extra footers. The message is clear enough to publish and demonstrates good subject discipline.