fix(security): harden Realtime WebSocket origins, worker guards, and Azure credentials (#2414)