refactor(server): non-DI islands read env via app-config

server/src/websocket.ts

@@ -1,4 +1,5 @@
 import { WebSocketServer, WebSocket } from 'ws';
+import { readEnv } from './app-config';
 import { db, canAccessTrip } from './db/database';
 import { consumeEphemeralTokenWithMeta } from './services/ephemeralTokens';
 import { emitPluginEvent, pluginEventMeta } from './plugin-event-sink';
@@ -31,9 +32,7 @@ const socketMsgCounts = new WeakMap<NomadWebSocket, { count: number; windowStart
 
 /** Attaches a WebSocket server with JWT auth, room-based trip channels, and heartbeat keep-alive. */
 function setupWebSocket(server: http.Server): void {
-  const allowedOrigins = process.env.ALLOWED_ORIGINS
-    ? process.env.ALLOWED_ORIGINS.split(',').map(o => o.trim())
-    : null;
+  const allowedOrigins = readEnv().http.wsOrigins;
 
   wss = new WebSocketServer({
     server,