fix: pass OAuth cookie token to Hocuspocus WebSocket auth

The WebSocket provider doesn't send the OAuth token in the protocol
message. Extract it from the HTTP cookie during the upgrade request
and pass it via context to onAuthenticate.

Made-with: Cursor

backend/src/server.ts

@@ -54,13 +54,16 @@ if (oauthEnabled) {
 }
 
 const hocuspocus = new Hocuspocus({
-  async onAuthenticate({ token }: { token: string }) {
+  async onAuthenticate({ token, context }: { token: string; context: any }) {
     if (!oauthEnabled) return;
 
-    const user = await resolveUser(token);
+    // Prefer WebSocket protocol token, fall back to cookie token passed via context
+    const authToken = token || context?.token;
+    const user = await resolveUser(authToken);
     if (!user || !user.canEdit) {
       throw new Error("Unauthorized: no write access");
     }
+    if (authToken) setUserToken(authToken);
     return { user };
   },
   extensions: [
@@ -143,7 +146,8 @@ app.get("/api/auth/status", async (req, res) => {
 // ---------- Collab WebSocket ----------
 
 app.ws("/collab/:doc", (ws, req) => {
-  hocuspocus.handleConnection(ws, req);
+  const token = extractToken(req.headers.cookie);
+  hocuspocus.handleConnection(ws, req, { token });
 });
 
 // ---------- AI Chat ----------