The shared authenticate, validate, and tenant-bind resolver used by the ticket route.
The runner namespace the per-run channel forwards to (idFromName wf:runId).
The dedicated stream-ticket signing secret (STREAM_TICKET_SECRET).
OptionalwsOptional origin for the ws:// URL returned by the ticket route (e.g.
wss://host). Omitted => a same-origin relative path the browser resolves
against the page origin.
The per-tenant hub namespace the hub channel forwards to.