feat: define realtime authentication frame

contracts/v1/realtime-auth-frame.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trixie.reaperofveriod.nl/contracts/v1/realtime-auth-frame.json",
+  "title": "Trixie realtime authentication frame",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["frame_type", "token"],
+  "properties": {
+    "frame_type": { "const": "authenticate" },
+    "token": { "type": "string", "minLength": 1 }
+  }
+}

docs/contract-testing.md

@@ -10,3 +10,9 @@ deliver it over an authenticated WebSocket or a future compatible transport, but
 the event identity and payload rules remain the same. `event_id` is the stable
 deduplication key for at-least-once delivery.
 
+Browser clients authenticate the WebSocket with the first text frame described
+by `realtime-auth-frame.json`. Session tokens are sent in that frame rather
+than in a URL query parameter. The server closes the connection when the frame
+is missing, malformed, or invalid, and sends `connection.ready` only after
+successful validation.
+

fixtures/v1/realtime-auth-frame.json

@@ -0,0 +1,4 @@
+{
+  "frame_type": "authenticate",
+  "token": "synthetic-session-token"
+}