fix(sse): add a protocol-level ping/pong heartbeat to LiveWS

[maxmad64bis]

⚠️ base-red inherited: #9985

Summary

• startHeartbeat() only refreshes a client's liveness on inbound application messages. That was
  deliberate (fix(dashboard): send periodic WS heartbeat pings to stop live-dashboard reconnect churn #10452): renewing it on the server's own outbound pong would keep a half-open socket
  alive indefinitely. But it also evicts a legitimate read-only subscriber — any dashboard watching
  a live feed without interacting — after HEARTBEAT_TIMEOUT_MS.
• Sends a protocol-level ping (RFC 6455 §5.5.2) on the same tick. Conformant clients answer with a
  pong control frame automatically, refreshed in a new ws.on("pong") handler. A socket that
  stopped reading frames still does not answer and is reaped exactly as before, so fix(dashboard): send periodic WS heartbeat pings to stop live-dashboard reconnect churn #10452's
  protection is unchanged. The application-level pong is kept for clients that still rely on it.

Related Issues

• Related to fix(dashboard): send periodic WS heartbeat pings to stop live-dashboard reconnect churn #10452.

Validation

• Change type: other (WebSocket server)
• Focused tests and category gates from the golden path:
  tests/integration/live-ws-heartbeat-keepalive.test.ts against a real spawned server,
  npm run test:vitest (368/368)
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR
• SonarQube is temporarily opt-in while the private project has no quota; it is not a PR gate.

Tests Added Or Updated

• tests/integration/live-ws-heartbeat-keepalive.test.ts

The existing #10452 test gains a third connection mode, so both properties are proven together: a
socket that stopped reading frames is still reaped, and a quiet-but-alive subscriber survives.

Coverage Notes

• src/server/ws/liveServer.ts gains two statements — the ping call and the pong handler. Both are
  exercised by the integration test above against a real server process, which is the only layer
  where a protocol-level control-frame round trip can be observed.

Reviewer Notes

• The "stopped reading" case pauses the underlying socket through ws's private _socket. There
  is no public API to model a half-open socket, and terminate() would model a close instead. It
  fails loudly if ws ever changes that internal.
• That client cannot observe its own closure either, so the assertion reads the server's disconnect
  log rather than readyState.
• The test needs a ~50s window to cross HEARTBEAT_TIMEOUT_MS. It reuses the harness and timing of
  the already-merged fix(dashboard): send periodic WS heartbeat pings to stop live-dashboard reconnect churn #10452 test and adds no wall-clock cost — the three clients connect in
  parallel before the single wait.