feat(interactive): attach TTY sessions through the apiserver websocket relay

Step 2 of the interactive-job UX work: `-I --tty` now attaches the session
to the submitting terminal by default instead of opening a browser.

Producer/consumer shape (user clusters cannot reach worker ttyd ports):

  xcecli (-I --tty, raw terminal)
    <-> GET /xce/v1/jobs/:id/attach (JWT auth + job:control ownership)
      <-> ws://worker:ttyd-port/ws (ttyd)

apiserver (controllers/job_attach.go):
- new websocket relay endpoint, route gated by RequirePermission("job:control");
  owner may always attach, others need a job:control scope covering the owner
- JWT accepted from the Authorization header or ?token= query param
  (browser WebSocket API cannot set headers)
- bidirectional frame pump with policy close codes: 4000 = cannot reach the
  session on the worker, 4001 = session ended
- the worker hop dials with the "tty" websocket subprotocol: ttyd 1.7.7
  completes the handshake without it but then stays silent (verified against
  the deployed binary)

xcecli (cmd/jobs/attach.go):
- attach client: dials the relay, raw mode via golang.org/x/term, ttyd
  wire format (TEXT hello {"AuthToken",columns,rows}; binary frames
  '0'+input, '1'+resize JSON, output '0' to stdout), SIGWINCH resize
  forwarding, terminal restored on every exit path
- submit.go: --browse flag opens the web URL instead of attaching (TTY jobs
  attach by default; XJOB/VNC keeps the browser path); the URL line is
  always printed as a record
- waitForInteractiveURL no longer fails when the job is RUN but the worker's
  start report (carrying the URL) has not landed yet -- poll and retry

Verified on t1: raw-client and real-xcecli attach round trips through the
relay (echo both ways), kill -> EXIT with URL retained, batch jobs unaffected,
all daemons healthy. Suites: meson 'apiserver backend' 1/1, CGO_ENABLED=0
controllers/router and xcecli tests green.

Co-Authored-By: Claude Code <noreply@anthropic.com>

src/frontend/apiserver/vendor/modules.txt

@@ -104,6 +104,9 @@ github.com/golang-jwt/jwt/v4
 # github.com/google/uuid v1.6.0
 ## explicit
 github.com/google/uuid
+# github.com/gorilla/websocket v1.5.3
+## explicit; go 1.12
+github.com/gorilla/websocket
 # github.com/hashicorp/hcl v1.0.0
 ## explicit
 github.com/hashicorp/hcl