Document the WebSocket Message Schema

[maugauwi-hash]

Labels: documentation, api-contract
Priority: Medium
Estimated Time: 1 hour

Description:
shared/api-contract.md's WebSocket section is a single line: the URL and "real-time vault
events." No event types, payload shapes, authentication-over-WS mechanism, or reconnection guidance
are specified — blocking both #20 and #69 (and their joint tracking item #110) from being
implemented against a well-defined contract.

Tasks:

• Document each event type the socket can emit (e.g., balance change, status change, TTL update) with its payload shape
• Document how the connection authenticates (query param token? header? initial handshake message?)
• Document expected reconnection/heartbeat behavior so both clients implement it identically

---