Respect custom CheckOrigin on WebSocket upgrades

[Copilot]

The WebSocket acceptor was always overriding CheckOrigin, ignoring caller-provided origin policy.

• Connection upgrade: Preserve a supplied websocket.Upgrader.CheckOrigin; only default to permissive origin when none is provided.
• Coverage: Added test ensuring a rejecting CheckOrigin prevents upgrades and leaves the pool empty.

func (s *Stream) Accept(w http.ResponseWriter, r *http.Request, key string) error {
    if s.u.CheckOrigin == nil {
        s.u.CheckOrigin = func(*http.Request) bool { return true }
    }
    conn, err := s.u.Upgrade(w, r, nil)
    // ...
}

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.