WebSocket crash events broadcast to all clients without subscription enforcement

The WebSocket layer broadcast Crash game events to all connected clients without checking subscription state. Subscription was implemented client-side only; the server did not filter outbound events by subscription.

• Privacy leak: Per-client gameplay events visible to every connected user.
• Bandwidth amplification / DoS risk: Increased outbound bandwidth per backend event, scaling with connected client count rather than subscribed client count.

Maintain server-side subscription state per WebSocket connection. Only emit events to connections that have explicitly subscribed to the relevant channel. Add per-channel rate limits and authentication checks at subscription time, not just at connection time.

Fair Casino: Fixed. Zealynx: Verified.