fix(security): enforce membership authorization on WebSocket circle-room subscribe

[cypriannwokolo2-creator]

Summary

internal/websocket/client.go:166-170 allows any authenticated user to subscribe to any circle room with no membership check - a data-leak/IDOR vector for private circle events.

Acceptance Criteria

• Verify the subscribing user is a member of the circle before joining the room
• Enforce for private/community (token-gated) circles
• Tests for non-member rejection

Complexity

High.

[Bosskandy1]

@Bosskandy1 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi, I’d like to work on this issue. I can enforce membership authorization for WebSocket circle room subscriptions, cover private and token gated circles, and add tests to ensure non-members are properly rejected.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Bosskandy1 to this issue.

[Halimatyemisi]

@Halimatyemisi has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer, I’ve gone through the issue details and understand the expected outcome. I’m confident I can work on it successfully. Kindly assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Halimatyemisi to this issue.

[cypriannwokolo2-creator]

Already implemented: Hub.JoinRoom calls auth.CanSubscribe which verifies circle membership via circle.Service.IsMember(). Public circles allowed for all.