H-337: restore Web widget reply visibility (#64)

* H-337: restore widget reply delivery

* H-337: harden widget conversation ownership

---------

Co-authored-by: Rogee <rogee@ipao.vip>

backend/internal/ws/coverage5_test.go

@@ -109,7 +109,7 @@ func TestAuthenticate_PubsubTokenWithoutUserID_Cov5(t *testing.T) {
 	claims, err := authenticator.Authenticate(c)
 	require.Error(t, err)
 	assert.Nil(t, claims)
-	assert.Contains(t, err.Error(), "requires 'user_id' parameter")
+	assert.Contains(t, err.Error(), "invalid pubsub_token")
 }
 
 func TestAuthenticate_PubsubToken_InvalidUserID_Cov5(t *testing.T) {