feat: add onTokenSync hook for auth token re-sync

[0xb4lamx]

Problem

Currently, Hocuspocus only validates user authentication during the initial handshake. If a user's token expires, or permissions change while they have an active connection, they can continue editing documents until they reconnect.

Solution

This PR suggests the first step towards "periodic" reauth (ref: #752) by adding a token synchronization mechanism. The server can now request the current token from any connected provider, enabling validation of user permissions without requiring a full reconnection.

Changes

• sendToken() - Provider method to send current token to server
• requestToken() - Server method to request token from provider
• onTokenSync hook - Server hook triggered when token is received
• TokenSync message type - New message type for token synchronization

Looking for Feedback

• any concerns about the flow or hook naming?
• should we add additional error handling for token validation failures?
  • should onTokenSync hook failures trigger disconnection?
  • what happens if provider doesn't respond to requestToken()?
• documentation needs to be added for the new onTokenSync hook
• no built-in periodic validation yet (still could be implemented outside of Hocuspocus context...)

[janthurau]

Thank you for your PR!

Wondering if we need a new message type that the provider sends, or if it can just send the usual Auth message and we handle that in the server? That would probably also solve https://github.com/ueberdosis/hocuspocus/pull/1001/files#diff-2f3921abc2796f1f97fc6ca37bea53ef1a43b7327e68645d7f546653e04e6958R114 then

[0xb4lamx]

Thank you for your PR!

Wondering if we need a new message type that the provider sends, or if it can just send the usual Auth message and we handle that in the server? That would probably also solve https://github.com/ueberdosis/hocuspocus/pull/1001/files#diff-2f3921abc2796f1f97fc6ca37bea53ef1a43b7327e68645d7f546653e04e6958R114 then

My initial idea was to separate authentication from token sync, since the latter doesn’t always constitute an authentication operation.
I did push a new version which reuses the AuthenticationMessage for token sync as well, wdyt? @janthurau

[0xb4lamx]

any further thoughts @janthurau? I did push some docs around the new hook.