feat(web-next): custom Node server hosting Next.js + Socket.IO on port 3000

Replaces `next dev` / `next start` with a custom Node http server that
co-hosts Next.js and Socket.IO on the same port, wiring in the
RealtimeHandlerRegistry and session-cookie-based IRealtimeAuthenticator.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web-next/server.ts

@@ -0,0 +1,62 @@
+// apps/web-next/server.ts
+// SERVER-ONLY entry. Boots Next.js + Socket.IO on the same Node http server.
+import "reflect-metadata";
+import { createServer } from "node:http";
+import next from "next";
+import { Server as IOServer } from "socket.io";
+import {
+  RealtimeHandlerRegistry,
+  SocketIORealtimeBroadcaster,
+  SocketIORealtimeServer,
+  type IRealtimeAuthenticator,
+} from "@repo/core-realtime";
+import { SESSION_COOKIE } from "@repo/auth";
+import { authContainer } from "@repo/auth/di/container";
+import { AUTH_SYMBOLS } from "@repo/auth/di/symbols";
+import { bindAll } from "./src/server/bind-production.js";
+
+const dev = process.env.NODE_ENV !== "production";
+const port = Number(process.env.PORT ?? 3000);
+
+const app = next({ dev });
+const handle = app.getRequestHandler();
+
+await app.prepare();
+
+const httpServer = createServer((req, res) => handle(req, res));
+const io = new IOServer(httpServer);
+
+const broadcaster = new SocketIORealtimeBroadcaster(io);
+const registry = new RealtimeHandlerRegistry();
+
+await bindAll({ realtime: broadcaster, realtimeRegistry: registry });
+
+const authenticator: IRealtimeAuthenticator = {
+  authenticate: async ({ cookies }) => {
+    const sessionId = cookies[SESSION_COOKIE];
+    if (!sessionId) return null;
+    const authService = authContainer.get<{
+      validateSession: (id: string) => Promise<{ user: { id: string }; session: unknown } | null>;
+    }>(AUTH_SYMBOLS.IAuthenticationService);
+    const result = await authService.validateSession(sessionId);
+    return result
+      ? {
+          userId: result.user.id,
+          // Roles are not yet in the session shape; extend here when DB-backed roles ship.
+          roles: (result as unknown as { roles?: string[] }).roles ?? [],
+        }
+      : null;
+  },
+};
+
+const realtimeServer = new SocketIORealtimeServer({
+  httpServer,
+  io,
+  authenticator,
+  registry,
+});
+await realtimeServer.start();
+
+httpServer.listen(port, () => {
+  console.log(`> Ready on http://localhost:${port}`);
+});