feat(vela-gateway): add websocket session skeleton

docs/protocol.md

@@ -5,6 +5,12 @@
 The shared code-level contract lives in the Yarn workspace package `@vela/protocol` so both the
 gateway and UI import the same event names and envelope shape.
 
+Current gateway baseline:
+
+- WebSocket endpoint: `/ws`
+- the gateway sends `session.ready` and `session.state` immediately after a successful socket upgrade
+- the gateway accepts JSON text messages only in the shared envelope shape
+
 ## WebSocket Message Envelope
 
 Every WebSocket message uses one envelope format:
@@ -40,6 +46,17 @@ type ClientEvent =
 - `input_audio.commit` marks the current buffered user turn as ready for downstream processing
 - `response.cancel` interrupts the active listen/think/speak flow
 
+### Current skeleton behavior
+
+- on connect, the gateway creates an ephemeral in-memory session and emits `session.ready` plus `session.state`
+- `session.start` is accepted as an idempotent session acknowledgment and re-sends readiness/state
+- `input_audio.append` updates the ephemeral session record and moves the session to `listening`
+- `input_audio.commit` resets the minimal buffered state and returns the session to `idle`
+- `response.cancel` resets the minimal session state back to `idle`
+- malformed JSON produces `error` with code `invalid_json`
+- invalid envelopes or unsupported client event names produce `error` with code `invalid_message`
+- malformed WebSocket frames are rejected without crashing the gateway process
+
 ### Server → Client
 
 ```ts