🔒 [security fix] Enable WebSocket masking in server

[TheRealAshik]

🎯 What: The vulnerability fixed is the disabled WebSocket masking in the Ktor server configuration.
⚠️ Risk: Disabling masking can leave the server vulnerable to cache poisoning attacks and other intermediaries that might misinterpret unmasked frames as standard HTTP traffic.
🛡️ Solution: Changed masking = false to masking = true in the WebSockets plugin installation in Application.kt.

---

PR created automatically by Jules for task 10041019458702965557 started by @TheRealAshik

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[gemini-code-assist]

Code Review

This pull request enables WebSocket masking on the server side. However, feedback indicates that this violates RFC 6455, which mandates that servers must not mask frames sent to clients, and a suggestion was made to revert this change to maintain protocol compliance.

[gemini-code-assist]

Enabling masking on the server side violates the WebSocket protocol (RFC 6455, Section 5.1). The specification states: "A server MUST NOT mask any frames that it sends to the client." Most compliant clients (including all modern web browsers) will immediately close the connection if they receive a masked frame from the server. The security concern regarding cache poisoning mentioned in the PR description is addressed by client-to-server masking, which is mandatory for clients and should not be enabled on the server for outgoing frames.

Suggested change

	masking = true
	masking = false