sec: enforce channel ACL prefixes (presence- + reserved _)

[EthanY33]

Summary

Closes #8.

The original handler had two prefix-related gaps:

1. presence-* channels (Pusher's protocol convention for authenticated channels with member metadata) were treated as public. Anyone with a socket could subscribe to presence-room-1 and read every publish.
2. _*-prefixed channels were rejected only on publish. Subscribe ignored the rule, so an attacker could subscribe to a server-reserved name before the server ever publishes there.

This PR replaces the inline strings.HasPrefix checks with two named, data-driven helpers:

// _-prefixed names are reserved on both subscribe and publish.
func channelReserved(name string) bool

// private-* and presence-* require a signed token whose HMAC includes
// the channel name; a token for private-X cannot subscribe private-Y.
func channelRequiresAuth(name string) bool

The authRequiredPrefixes slice is package-level data, so a new prefix is a one-liner.

What changed

• internal/conn/handler.go:
  • New channelReserved / channelRequiresAuth helpers + authRequiredPrefixes slice.
  • handleSubscribe: reserved -> error; auth required -> verify; otherwise public.
  • handlePublish: same channelReserved check.
• internal/conn/handler_test.go: 3 new test cases.

Test plan

• go build ./... clean.
• go test ./internal/conn/... passes (3 new tests + existing).
• Manual: subscribe channel=presence-room without token returns AUTH_FAILED.
• Manual: subscribe channel=presence-room with a token signed for that channel returns subscribed.
• Manual: subscribe channel=_internal returns RESERVED_CHANNEL.

Conflict notes

internal/conn/handler.go overlaps with PR #20 (channel GC + sub rate limit), PR #17 (channel name length cap), and PR #23 (token jti / replay cache). All overlaps are at distinct lines / additive — small textual rebase whichever lands second.