Middleware Outside The Hijacker

Request-scoped middleware (auth, rate limit, RBAC) is wrapped around a handler that upgrades a single request into a long-lived connection. The middleware authenticates the handshake, then never sees the streams that follow.