refactor: narrow auth service to smaller units

Easier for testing, and omits need for full dep injection for pusher service, where we passed in nil for deps dangerously.

go/internal/pusher/server.go

@@ -18,12 +18,12 @@ type Server struct {
 	ctx     context.Context // server-scoped context for graceful shutdown
 	hub     *Hub
 	bridge  *RedisBridge
-	authSvc auth.AuthService
+	authSvc auth.SessionReader
 }
 
 // NewServer creates a new pusher server. The ctx controls the lifetime of all
 // WebSocket connections — when cancelled, all connections are closed gracefully.
-func NewServer(ctx context.Context, hub *Hub, bridge *RedisBridge, authSvc auth.AuthService) *Server {
+func NewServer(ctx context.Context, hub *Hub, bridge *RedisBridge, authSvc auth.SessionReader) *Server {
 	return &Server{
 		ctx:     ctx,
 		hub:     hub,