refactor(broker): merge HTTP+WS to single port, populate senderPubkey on push

Single-port refactor:
- Drop the BROKER_PORT+1 HTTP side-port. Use `ws` with noServer:true
  and attach to a single node:http server via the 'upgrade' event.
- Clients connect to ws://host:PORT/ws
- Hook POSTs go to http://host:PORT/hook/set-status
- Health probe at http://host:PORT/health
- One port = one Traefik label, one cert, one deploy route. Matches
  the Coolify/VPS operational constraints.

senderPubkey on push:
- drainForMember now joins mesh.message_queue → mesh.member to return
  the sender's peerPubkey alongside each envelope. No extra round-trip,
  no cache invalidation needed (option A from review).
- index.ts populates WSPushMessage.senderPubkey from the join result
  instead of the empty-string placeholder.
- Receivers can now identify who sent a message directly from the push.

README updated with a routes table for the single-port layout.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/broker/README.md

@@ -23,11 +23,19 @@ pnpm --filter=@claudemesh/broker start   # production
 
 | Var                          | Default | Purpose                                             |
 | ---------------------------- | ------- | --------------------------------------------------- |
-| `BROKER_PORT`                | `7899`  | Port the WS server listens on                       |
+| `BROKER_PORT`                | `7899`  | Single port for HTTP routes + WebSocket upgrade     |
 | `DATABASE_URL`               | —       | Postgres connection string (shared with apps/web)   |
 | `STATUS_TTL_SECONDS`         | `60`    | Flip stuck-"working" peers to idle after this TTL   |
 | `HOOK_FRESH_WINDOW_SECONDS`  | `30`    | How long a hook signal beats JSONL inference        |
 
+## Routes (single port)
+
+| Path                 | Protocol  | Purpose                                   |
+| -------------------- | --------- | ----------------------------------------- |
+| `/ws`                | WebSocket | Authenticated peer connections            |
+| `/hook/set-status`   | HTTP POST | Claude Code hook scripts report status    |
+| `/health`            | HTTP GET  | Liveness probe                            |
+
 ## Depends on
 
 - `@turbostarter/db` — Drizzle/Postgres schema (uses the `mesh` pgSchema)