fix(security): JWT require env, remove *** token, WS auth disabled

fix(automation): implement all 6 actions + real cron parser
fix(db): pq.Array for TEXT[], add sqlmock tests
fix(schema): single source migrations
docs: v2 architecture + frontend refactor proposals

backend/websocket/hub.go

@@ -84,14 +84,28 @@ func (h *Hub) Run() {
 }
 
 // HandleWebSocket upgrades HTTP connection to WebSocket
+// Requires JWT token in query param ?token=<jwt>
 func (h *Hub) HandleWebSocket(w http.ResponseWriter, r *http.Request) {
+	// Verify JWT from query parameter
+	tokenString := r.URL.Query().Get("token")
+	if tokenString == "" {
+		h.logger.Warn().Msg("websocket connection rejected: missing token")
+		w.WriteHeader(http.StatusUnauthorized)
+		return
+	}
+
+	// TODO: Parse and validate JWT against cfg.JWTSecret
+	// For now, reject all unauthenticated connections
+	h.logger.Warn().Msg("websocket connection rejected: JWT validation not implemented")
+	w.WriteHeader(http.StatusUnauthorized)
+	return
+
 	conn, err := upgrader.Upgrade(w, r, nil)
 	if err != nil {
 		h.logger.Error().Err(err).Msg("websocket upgrade failed")
 		return
 	}
 
-	// Extract tenant and user from query params (in production, verify JWT)
 	tenantID := r.URL.Query().Get("tenant_id")
 	userID := r.URL.Query().Get("user_id")