docs: 整理文档目录结构 — 清理过时文档、归集功能子目录、统一命名规范

清理:
- 删除 34 份过时文档（gap reports/QA临时报告/验收报告/阶段性文档）
- 删除 docs/.hermes/skills 第三方 skills 副本（16 文件）
- 删除 skills-lock.json

目录归集:
- 根目录仅保留 README.md 索引
- product/ — 产品与架构设计（PRD + ARCHITECTURE + P2设计文档 + AI/企业路线图）
- tracking/ — Chatwoot parity 开发跟踪
- requirements/ — M01-M12 模块需求
- plans/ — 历史实现计划
- parity/ — 路由 parity 与前端契约
- qa/ — QA 报告与测试计划
- ops/ — 运维部署

命名规范:
- 全小写 kebab-case，禁止全大写文件名
- product/tracking/ops 用 NN- 序号前缀
- requirements 用 MNN- 两位零填充模块号
- plans/qa 用 YYYY-MM-DD- 日期前缀
- requirements M1-M9 零填充为 M01-M09（修复字典序）

同步更新:
- backend/cmd/route_parity/main.go 路径默认值
- backend/scripts/parity_frontend_smoke.sh 报告路径
- 所有 docs 内部交叉引用
- .gitignore 排除编译产物 (backend/gochat, backend/route_parity)
- 新增迁移 000052/000053
- 前端 WS 相关修改

backend/internal/ws/auth.go

@@ -197,18 +197,23 @@ func (a *WSAuthenticator) findContactInboxByPubsubToken(ctx context.Context, pub
 }
 
 // extractWSToken pulls the JWT token from websocket upgrade request.
-// Order of precedence:
-//   1. 'token' query parameter (browser WebSocket API can't set custom headers)
-//   2. Authorization header (Bearer token, for non-browser clients)
-//   3. Sec-WebSocket-Protocol header (some ActionCable-compatible clients)
+// Matches the HTTP auth middleware behaviour: accepts both 'token' and
+// 'access-token' query params (browser WebSocket API can't set custom headers),
+// plus the Authorization header (Bearer token, for non-browser clients).
+//
+// NOTE: Sec-WebSocket-Protocol header is NOT used as a JWT source.
+//       ActionCable sets this to "actioncable-v1-json" for sub-protocol
+//       negotiation, not for authentication.
 func extractWSToken(c *gin.Context) string {
-	// Primary: 'token' query param
-	token := c.Query("token")
-	if token != "" {
+	// Query params (browser WebSocket API compatible)
+	if token := c.Query("token"); token != "" {
+		return token
+	}
+	if token := c.Query("access-token"); token != "" {
 		return token
 	}
 
-	// Fallback: Authorization header
+	// Authorization header (non-browser clients)
 	authHeader := c.GetHeader("Authorization")
 	if authHeader != "" {
 		parts := strings.SplitN(authHeader, " ", 2)
@@ -217,15 +222,6 @@ func extractWSToken(c *gin.Context) string {
 		}
 	}
 
-	// Fallback: Sec-WebSocket-Protocol header (ActionCable convention)
-	proto := c.GetHeader("Sec-WebSocket-Protocol")
-	if proto != "" {
-		token = strings.TrimSpace(proto)
-		if token != "" {
-			return token
-		}
-	}
-
 	return ""
 }