chore: gate legacy websocket server path

[silentgeckoaudit3801]

Summary

• make
  pm run dev:ws route to the decoupled WebSocket server path
• add explicit dev:ws:legacy for the deprecated monolithic server
• require --legacy or OPEN_AUDIT_LEGACY_SERVER=1 before server.ts starts
• update README scripts and architecture notes so the decoupled path is the default and the monolith is clearly migration-only

Verification

• Parsed package.json after edits.
• Static reference check for dev:ws, dev:ws:legacy, --legacy, and the migration warning.
• I did not install dependencies or start the server in this environment to avoid executing third-party project code on the user's machine.

Fixes #242