Function ws_route 

pub fn ws_route(
    runtime: &'static GatewayRuntime,
    registry: &'static ConnectionRegistry,
    container: Arc<FrozenDiContainer>,
    tuning: WsTuning,
) -> MethodRouter

Build the axum MethodRouter that upgrades HTTP→WebSocket for one gateway.

If a JwtService has been provided in the DI container, the handshake is authenticated and the resulting claims are threaded through to every WsClient, so gateway handlers can call client.claims() for auth decisions. Credentials are taken from, in order: the Authorization: Bearer <token> header, a signed JWT cookie, or an ?access_token=<jwt> query param — the last of which is what makes the gateway reachable from a browser, since new WebSocket(url) cannot send headers. All three decode as access JWTs, so downstream auth is identical.