fix(server-ws): silence routine auth rejection logs

[Adamskiee]

What changed

• Stop emitting application warnings for routine invalid or expired WebSocket tokens.
• Apply the behavior consistently to signalling and GPS WebSocket routes.
• Keep Uvicorn's WebSocket 403 access-line filter aligned with the intentionally silent behavior.
• Update regression tests to assert that rejected connections still close with code 1008 without producing route logs.

Why

WebSocket authentication rejections are expected client input. The warning propagated through the app activity logger, whose formatter requires fields such as user_id, and produced a large logging traceback instead of a concise rejection.

The routes already close rejected sockets safely. Leaving these expected rejections silent removes the noisy traceback without changing authentication behavior.

Impact

Invalid-token WebSocket connections continue to be rejected with close code 1008. Operators no longer see warning or formatting tracebacks for routine signalling and GPS authentication failures.

Validation

• tests/test_websocket_auth_rejection.py: 8 passed
• WebSocket rejection suite plus missing and invalid GPS monitor token security cases: 10 passed
• git diff --check: passed

The full standalone server suite was also attempted. It reached 94 passing tests, with remaining failures caused by the local suite environment and shared test state, including rate-limit exhaustion, missing QA configuration, unavailable Redis, and legacy unauthenticated GPS test expectations.