app-server: remove TCP websocket listener

[euroelessar]

Why

The app-server no longer needs to expose a TCP websocket listener. Keeping that transport also kept around a separate listener/auth surface that is unnecessary now that local clients can use stdio or the Unix-domain control socket, while remote connectivity is handled by remote_control.

What Changed

• Removed ws://IP:PORT parsing and the AppServerTransport::WebSocket startup path.
• Deleted the app-server websocket listener auth module and removed related CLI flags/dependencies.
• Kept websocket framing only where it is still needed: over the Unix-domain control socket and in the outbound remote_control connection.
• Updated app-server CLI/help text and app-server/README.md to document only stdio://, unix://, unix://PATH, and off for local transports.
• Converted affected app-server integration coverage from TCP websocket listeners to UDS-backed websocket connections, and added a parse test that rejects ws:// listen URLs.
• Removed the now-unused workspace constant_time_eq dependency and refreshed Cargo.lock after cargo shear caught the drift.
• Moved test app-server UDS socket paths to short Unix temp paths so macOS Bazel test sandboxes do not exceed Unix socket path limits.

Verification

• Added/updated tests around UDS websocket transport behavior and ws:// listen URL rejection.
• cargo shear
• cargo metadata --no-deps --format-version 1
• cargo test -p codex-app-server unix_socket_transport
• cargo test -p codex-app-server unix_socket_disconnect
• just fix -p codex-app-server
• git diff --check

Local full Rust test execution was blocked before compilation by an external fetch failure for the pinned nornagon/crossterm git dependency. just bazel-lock-update and just bazel-lock-check were retried after the manifest cleanup but remain blocked by external BuildBuddy/V8 fetch timeouts.