fix(gateway): hash session tokens in WS auth; fix WS reconnect backoff

The token-hashing commit (57aec2c) never updated ServeWS to hash tokens
before querying the sessions table. Cookie and message-frame auth both
compared raw tokens against stored hashes, so every WS connection failed.

Also moved reconnectDelay to module scope so the exponential backoff
survives across connect() calls, and resets on successful open.

internal/gateway/client.go

@@ -280,11 +280,11 @@ func ServeWS(db *sql.DB, hub *Hub, logger *slog.Logger, w http.ResponseWriter, r
 		}
 	}
 
-	// Test candidates against Postgres sessions
+	// Test candidates against Postgres sessions (tokens are stored hashed)
 	for _, token := range candidateTokens {
 		err := db.QueryRowContext(context.Background(),
 			`SELECT u.id, u.username FROM sessions s JOIN users u ON u.id = s.user_id WHERE s.token = $1 AND s.expires_at > NOW()`,
-			token,
+			hashToken(token),
 		).Scan(&userID, &username)
 		if err == nil && userID != "" {
 			break
@@ -300,7 +300,7 @@ func ServeWS(db *sql.DB, hub *Hub, logger *slog.Logger, w http.ResponseWriter, r
 			if jsonErr := json.Unmarshal(raw, &auth); jsonErr == nil && auth.Token != "" {
 				_ = db.QueryRowContext(context.Background(),
 					`SELECT u.id, u.username FROM sessions s JOIN users u ON u.id = s.user_id WHERE s.token = $1 AND s.expires_at > NOW()`,
-					auth.Token,
+					hashToken(auth.Token),
 				).Scan(&userID, &username)
 			}
 		}