[Mathieu2301]

Summary

• replace the legacy Node/Firestore/FCM server with an in-memory Go relay pinned to Miakapp-V3 RFC 0001
• implement authenticated WebSocket sessions, atomic coordinator declarations, filtered state, live events, presence, and conservative call routing
• enforce bounded frames and queues, immutable principals, active lease expiry, generation fencing, declaration rollback, and ordered bootstrap/recovery delivery
• add race-enabled Go tests, a real MiakAPI SDK integration fixture, hardened distroless packaging, and pinned CI/publish workflows

Safety boundary

The standalone binary intentionally uses a rejecting verifier. It cannot authenticate a WebSocket session until the canonical platform control-plane contract defines token claims, audience, scopes, JWKS rotation, and revocation. /ping remains usable for container and network validation. This PR is an implementation preview, not a production deployment switch.

Production admission controls such as per-IP limits, total-home admission, and aggregate cross-connection memory budgets also remain part of that control-plane/deployment boundary.

Validation

• go test -race -shuffle=on ./...
• relay suite repeated 30 times
• go vet ./...
• go mod verify
• go build -trimpath ./cmd/miakapp-server
• real MiakAPI integration: generation 1, state mutation to 21, successful call, successful reauthentication
• Docker image built from digest-pinned bases and probed at /ping under UID 65532, read-only rootfs, no Linux capabilities
• workflow YAML, Compose configuration, shell syntax, Node syntax, formatting, and staged diff checks

Pinned contracts

• Miakapp-V3 protocol: b927789691dd8cdebc91b673853cdc6711fe057d
• MiakAPI integration SDK: 9463294af3353c128dced85309c468abddf87ad4 (feat: introduce the MiakAPI coordinator SDK v4 MiakAPI#1)