daemon: rpc/ws_server — loopback WebSocket transport + pairing (build step 1, second half)

The extension's fallback transport (docs/05 §4). veloxd now also listens
on 127.0.0.1, first free port in 52000-52016, and writes it to
<runtime>/ws.port (0600).

- rpc/ws_frame — RFC 6455 frame codec. Incremental; reassembles
  continuation frames; enforces "client frames MUST be masked" (§5.1);
  caps a reassembled message at 8 MiB. This is the attacker-adjacent
  parser, so it has its own test table.
- rpc/ws_handshake — HTTP upgrade parse, Sec-WebSocket-Accept
  (SHA-1 + base64 via libcrypto), and the two non-negotiable checks:
  an Origin header must be present and must be moz-extension:// (a page
  cannot pair). Version must be 13.
- rpc/ws_server — per-connection Handshake -> Open state machine on the
  shared EventLoop. Token gate: session.pair mints a token behind the
  approver + rate limiter; session.hello must present a valid one;
  every other method is -32002 until authed. Privileged methods are
  refused -32003 by the generated dispatch(). Ping -> Pong; Close
  echoed. session.hello major-version mismatch -> -32001.
- rpc/pairing — PairingApprover interface + EnvAutoApprover dev stub
  (approves iff VELOX_PAIR_AUTO=1); PairingRateLimiter (5 failures / 60 s
  per origin, then 60 s lockout -> -32014, survives reconnect); a
  four-digit code generator.
- store/pairings — the pairings table: create() returns the plaintext
  token once and stores only its SHA-256; find_active_by_token,
  touch, revoke, list_active.
- util/crypto — sha1 / sha256_hex / base64 / random_token over libcrypto.
- store/sqlite — pin the DB file (and -wal/-shm) to 0600.
- runtime_dir — resolve_data_dir() for $XDG_DATA_HOME/velox (velox.db).
- main.cpp — opens + migrates velox.db, starts both transports; a WS
  bind failure is logged, not fatal (capture must fail open, the Unix
  socket still serves the GUI/CLI).

Real gap, flagged not hidden: the pairing prompt is EnvAutoApprover for
now — a GUI dialog / desktop notification is build step 7. Pairing
needs VELOX_PAIR_AUTO=1 until then.

Tests (ASan+UBSan and TSan clean): veloxd.ws_frame (codec + handshake
vectors incl. the RFC 6455 §1.3 accept sample), veloxd.pairings (token
create/find/revoke, hash-not-token, rate-limit window + lockout +
per-origin isolation + success reset), veloxd.ws_server (full flow: 101
handshake, -32002 gate, deny-then-approve pairing, hello-with-token,
-32003 privileged refusal, real download.list). 27 daemon/cli tests
green; full tree green.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Upd9WhG9oppieig5nRDLig

daemon/tests/CMakeLists.txt

@@ -1,19 +1,18 @@
 # daemon unit + integration tests. Registered with ctest; run via `ctest --preset dev`.
-# No external test framework — each file is a small self-checking binary (matches the
-# lightweight style core/ uses, without depending on core's private test support).
+# No external test framework — each file is a small self-checking binary.
 
-add_executable(veloxd_ndjson_test ndjson_test.cpp)
-target_link_libraries(veloxd_ndjson_test PRIVATE veloxd_rpc)
-target_compile_options(veloxd_ndjson_test PRIVATE -Wall -Wextra -Wpedantic -Werror)
-add_test(NAME veloxd.ndjson COMMAND veloxd_ndjson_test)
+function(veloxd_test name)
+    cmake_parse_arguments(T "" "" "LIBS" ${ARGN})
+    add_executable(veloxd_${name}_test ${name}_test.cpp)
+    target_link_libraries(veloxd_${name}_test PRIVATE ${T_LIBS})
+    target_compile_options(veloxd_${name}_test PRIVATE -Wall -Wextra -Wpedantic -Werror)
+    add_test(NAME veloxd.${name} COMMAND veloxd_${name}_test)
+    set_tests_properties(veloxd.${name} PROPERTIES TIMEOUT 30)
+endfunction()
 
-add_executable(veloxd_uds_roundtrip_test uds_roundtrip_test.cpp)
-target_link_libraries(veloxd_uds_roundtrip_test PRIVATE veloxd_rpc)
-target_compile_options(veloxd_uds_roundtrip_test PRIVATE -Wall -Wextra -Wpedantic -Werror)
-add_test(NAME veloxd.uds_roundtrip COMMAND veloxd_uds_roundtrip_test)
-set_tests_properties(veloxd.uds_roundtrip PROPERTIES TIMEOUT 30)
-
-add_executable(veloxd_store_migrations_test store_migrations_test.cpp)
-target_link_libraries(veloxd_store_migrations_test PRIVATE veloxd_store)
-target_compile_options(veloxd_store_migrations_test PRIVATE -Wall -Wextra -Wpedantic -Werror)
-add_test(NAME veloxd.store_migrations COMMAND veloxd_store_migrations_test)
+veloxd_test(ndjson           LIBS veloxd_rpc)
+veloxd_test(uds_roundtrip     LIBS veloxd_rpc)
+veloxd_test(store_migrations  LIBS veloxd_store)
+veloxd_test(pairings          LIBS veloxd_store veloxd_rpc)
+veloxd_test(ws_frame          LIBS veloxd_rpc)
+veloxd_test(ws_server         LIBS veloxd_rpc)