Mint a live WebSocket ticket for a work session

Mints a single-use, 60-second ticket for GET /workspace/sessions/{sessionId}/ws (the upgrade itself is not an API operation — a browser socket cannot carry a bearer, so the ticket IS the capability). Authorization: work_session:read on the session, OR space:contribute on one of its linked spaces; a desk session only for its owner. Any denial is 404. The ticket carries a capability view: full when the caller could also WRITE the session, otherwise sanitized, and only full sockets receive live frames. A read-only principal is one holding work_session:read without work_session:comment — the work-session-viewer role; participants, owners and space contributors all read full. The SAME view is applied to the HTTP reads (/entries, /turns, /artifacts), so the fallback path can never hand back what the socket withheld. The socket’s opening replay frame carries at most the LAST 200 entries, so a client that needs an older timeline pages GET /workspace/sessions/{sessionId}/entries with afterSeq and treats the socket as the live tail.