feat: add WebSocket collaboration handler

- Add CollaboratorWebSocket handler for real-time collaboration
- Add CollaborationHub field to Handler struct
- Add validateWSToken and colorFromDID helper functions
- Add RegisterClient/UnregisterClient methods to Room
- Wire up Hub in main.go and register /ws/docs/{rkey} route

cmd/server/main.go

···
 	"time"
 
 	"github.com/limeleaf/diffdown/internal/auth"
+	"github.com/limeleaf/diffdown/internal/collaboration"
 	"github.com/limeleaf/diffdown/internal/db"
 	"github.com/limeleaf/diffdown/internal/handler"
 	"github.com/limeleaf/diffdown/internal/middleware"
···
 			"templates/"+name,
 		))
 	}
-	h := handler.New(database, tmpls, baseURL)
+
+	collabHub := collaboration.NewHub()
+	h := handler.New(database, tmpls, baseURL, collabHub)
 
 	// Routes
 	mux := http.NewServeMux()
···
 	mux.HandleFunc("GET /docs/{rkey}/accept", h.AcceptInvite)
 	mux.HandleFunc("POST /api/docs/{rkey}/comments", h.CommentCreate)
 	mux.HandleFunc("GET /api/docs/{rkey}/comments", h.CommentList)
+
+	// WebSocket
+	mux.HandleFunc("GET /ws/docs/{rkey}", h.CollaboratorWebSocket)
 
 	// Middleware stack
 	stack := middleware.Logger(

go.mod

···
 require (
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/gorilla/sessions v1.2.2
+	github.com/gorilla/websocket v1.5.3
 	github.com/mattn/go-sqlite3 v1.14.22
 	github.com/oklog/ulid/v2 v2.1.0
 	github.com/yuin/goldmark v1.7.1

go.sum

···
 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo=
 github.com/gorilla/sessions v1.2.2 h1:lqzMYz6bOfvn2WriPUjNByzeXIlVzURcPmgMczkmTjY=
 github.com/gorilla/sessions v1.2.2/go.mod h1:ePLdVu+jbEgHH+KWw8I1z2wqd0BAdAQh/8LRvBeoNcQ=
+github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg=
+github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/oklog/ulid/v2 v2.1.0 h1:+9lhoxAP56we25tyYETBBY1YLA2SaoLvUFgrP2miPJU=

internal/collaboration/client.go

···
 			}
 			break
 		}
-		_ = message
+		var msg ClientMessage
+		if err := json.Unmarshal(message, &msg); err != nil {
+			log.Printf("Failed to parse message from %s: %v", c.DID, err)
+			continue
+		}
+		log.Printf("Received message type=%s from %s", msg.Type, c.DID)
 	}
 }
 

internal/collaboration/hub.go

···
 
 import (
 	"encoding/json"
+	"log"
 	"sync"
 )
 
···
 			r.mu.Lock()
 			r.clients[client] = true
 			r.mu.Unlock()
+			r.broadcastPresence()
 		case client := <-r.unregister:
 			r.mu.Lock()
 			if _, ok := r.clients[client]; ok {
···
 				close(client.send)
 			}
 			r.mu.Unlock()
+			r.broadcastPresence()
 		case message := <-r.broadcast:
 			r.mu.RLock()
 			for client := range r.clients {
···
 	r.broadcast <- message
 }
 
+func (r *Room) RegisterClient(client *Client) {
+	r.register <- client
+}
+
+func (r *Room) UnregisterClient(client *Client) {
+	r.unregister <- client
+}
+
 func (r *Room) GetPresence() []PresenceUser {
 	r.mu.RLock()
 	defer r.mu.RUnlock()
···
 		Type:  "presence",
 		Users: r.GetPresence(),
 	}
-	data, _ := json.Marshal(presence)
+	data, err := json.Marshal(presence)
+	if err != nil {
+		log.Printf("broadcastPresence: marshal failed: %v", err)
+		return
+	}
 	r.Broadcast(data)
 }

internal/handler/handler.go

···
 	"strings"
 	"time"
 
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/gorilla/websocket"
+
 	"github.com/limeleaf/diffdown/internal/atproto/xrpc"
 	"github.com/limeleaf/diffdown/internal/auth"
 	"github.com/limeleaf/diffdown/internal/collaboration"
···
 const collectionDocument = "com.diffdown.document"
 
 type Handler struct {
-	DB      *db.DB
-	Tmpls   map[string]*template.Template
-	BaseURL string
+	DB               *db.DB
+	Tmpls            map[string]*template.Template
+	BaseURL          string
+	CollaborationHub *collaboration.Hub
 }
 
-func New(database *db.DB, tmpls map[string]*template.Template, baseURL string) *Handler {
-	return &Handler{DB: database, Tmpls: tmpls, BaseURL: baseURL}
+func New(database *db.DB, tmpls map[string]*template.Template, baseURL string, collabHub *collaboration.Hub) *Handler {
+	return &Handler{DB: database, Tmpls: tmpls, BaseURL: baseURL, CollaborationHub: collabHub}
 }
 
 // --- Template helpers ---
···
 
 	h.jsonResponse(w, map[string]string{"html": rendered}, http.StatusOK)
 }
+
+var upgrader = websocket.Upgrader{
+	CheckOrigin: func(r *http.Request) bool { return true },
+}
+
+func (h *Handler) CollaboratorWebSocket(w http.ResponseWriter, r *http.Request) {
+	rKey := r.PathValue("rkey")
+	if rKey == "" {
+		http.Error(w, "Invalid document", http.StatusBadRequest)
+		return
+	}
+
+	accessToken := r.URL.Query().Get("access_token")
+	dpopProof := r.URL.Query().Get("dpop_proof")
+	if accessToken == "" || dpopProof == "" {
+		http.Error(w, "Missing auth tokens", http.StatusUnauthorized)
+		return
+	}
+
+	did, name, err := h.validateWSToken(accessToken, dpopProof)
+	if err != nil {
+		http.Error(w, "Invalid tokens", http.StatusUnauthorized)
+		return
+	}
+
+	user, err := h.DB.GetUserByDID(did)
+	if err != nil {
+		http.Error(w, "No user found", http.StatusUnauthorized)
+		return
+	}
+
+	session, err := h.DB.GetATProtoSession(user.ID)
+	if err != nil || session == nil {
+		http.Error(w, "No ATProto session", http.StatusUnauthorized)
+		return
+	}
+
+	client, err := h.xrpcClient(session.UserID)
+	if err != nil {
+		http.Error(w, "Failed to connect to ATProto", http.StatusInternalServerError)
+		return
+	}
+
+	doc, err := client.GetDocument(rKey)
+	if err != nil {
+		http.Error(w, "Document not found", http.StatusNotFound)
+		return
+	}
+
+	isCollaborator := false
+	for _, c := range doc.Collaborators {
+		if c == did {
+			isCollaborator = true
+			break
+		}
+	}
+	if !isCollaborator {
+		http.Error(w, "Not a collaborator", http.StatusForbidden)
+		return
+	}
+
+	color := colorFromDID(did)
+
+	conn, err := upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		log.Printf("WebSocket upgrade failed: %v", err)
+		return
+	}
+
+	room := h.CollaborationHub.GetOrCreateRoom(rKey)
+	wsClient := collaboration.NewClient(h.CollaborationHub, conn, did, name, color, rKey)
+	room.RegisterClient(wsClient)
+
+	go wsClient.WritePump()
+	wsClient.ReadPump()
+}
+
+func (h *Handler) validateWSToken(accessToken, dpopProof string) (string, string, error) {
+	claims := &jwt.MapClaims{}
+	parser := jwt.Parser{}
+	_, _, err := parser.ParseUnverified(accessToken, claims)
+	if err != nil {
+		return "", "", err
+	}
+
+	did, ok := (*claims)["sub"].(string)
+	if !ok {
+		return "", "", fmt.Errorf("no sub in token")
+	}
+
+	name, _ := (*claims)["name"].(string)
+	return did, name, nil
+}
+
+func colorFromDID(did string) string {
+	colors := []string{"#e74c3c", "#3498db", "#2ecc71", "#9b59b6", "#f39c12"}
+	hash := 0
+	for _, c := range did {
+		hash += int(c)
+	}
+	return colors[hash%len(colors)]
+}