fix(guest): tear down guest WS on guest-mode config change

An open guest WebSocket stamped isGuest/botScope once at upgrade and
never rechecked them, so it kept streaming bot state after an admin
disabled guest mode or narrowed guestMode.bots. setupWebSocket now
returns { cleanup, refreshGuestPolicy }; POST /api/bot/settings invokes
refreshGuestPolicy after saving a guestMode change, force-closing guest
sockets when disabled and live re-scoping them otherwise.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/web/websocket-auth.test.ts

@@ -102,7 +102,7 @@ describe("WebSocket guest bot scope", () => {
       off: () => {},
       removeListener: () => {},
     };
-    const cleanup = setupWebSocket(fakeWss, botManager, {
+    const { cleanup } = setupWebSocket(fakeWss, botManager, {
       debug() {},
       error() {},
       info() {},
@@ -114,3 +114,68 @@ describe("WebSocket guest bot scope", () => {
     cleanup();
   });
 });
+
+describe("WebSocket refreshGuestPolicy", () => {
+  function makeHarness() {
+    const clients: any[] = [];
+    const fakeWss: any = {
+      on: (ev: string, cb: any) => {
+        if (ev === "connection") fakeWss._conn = cb;
+      },
+    };
+    const botManager: any = {
+      getAllBots: () => [],
+      on: () => {},
+      off: () => {},
+      removeListener: () => {},
+    };
+    const logger = { debug() {}, error() {}, info() {}, warn() {} } as any;
+    const controller = setupWebSocket(fakeWss, botManager, logger);
+    // Connect fake sockets via the connection handler so they land in `clients`.
+    const connect = (ws: any) => {
+      clients.push(ws);
+      fakeWss._conn(ws);
+    };
+    return { controller, connect };
+  }
+
+  function makeFakeWs(opts: { isGuest: boolean; botScope?: "all" | Set<string> }) {
+    const closeCalls: Array<{ code?: number; reason?: string }> = [];
+    const ws: any = {
+      readyState: 1,
+      isGuest: opts.isGuest,
+      botScope: opts.botScope,
+      send: () => {},
+      on: () => {},
+      close: (code?: number, reason?: string) => closeCalls.push({ code, reason }),
+    };
+    return { ws, closeCalls };
+  }
+
+  it("disabling guest mode closes guest sockets but leaves non-guest sockets open", () => {
+    const { controller, connect } = makeHarness();
+    const guest = makeFakeWs({ isGuest: true, botScope: new Set(["bot1"]) });
+    const member = makeFakeWs({ isGuest: false, botScope: "all" });
+    connect(guest.ws);
+    connect(member.ws);
+
+    controller.refreshGuestPolicy({ enabled: false, bots: "all" });
+
+    expect(guest.closeCalls.length).toBe(1);
+    expect(guest.closeCalls[0].code).toBe(1008);
+    expect(member.closeCalls.length).toBe(0);
+  });
+
+  it("narrowing the guest scope live re-scopes open guest sockets", () => {
+    const { controller, connect } = makeHarness();
+    const guest = makeFakeWs({ isGuest: true, botScope: new Set(["bot1"]) });
+    connect(guest.ws);
+
+    controller.refreshGuestPolicy({ enabled: true, bots: ["bot2"] });
+
+    expect(guest.closeCalls.length).toBe(0);
+    expect(guest.ws.botScope instanceof Set).toBe(true);
+    expect(guest.ws.botScope.has("bot2")).toBe(true);
+    expect(guest.ws.botScope.has("bot1")).toBe(false);
+  });
+});