fix(webserver): fix CWebSocket memory leaks and address AI quality findings - #29

Summary

Addresses findings from the GitHub AI quality scan on src/webserver/src/WebSocket.cpp.

fix: add CWebSocket destructor to prevent chunk list and buffer leaks

CWebSocket had no destructor, so when a socket was destroyed with pending
write data the entire CChunk linked list and m_pBuf were silently leaked.

The fix adds ~CWebSocket() that walks the list using the same
save-next-then-delete pattern already used in OnSend(). Adding
delete m_pNext to ~CChunk() instead (the AI's suggested approach)
would be wrong: OnSend() saves pNext before calling delete m_pHead,
so recursive chain deletion inside the destructor would cause a
use-after-free there.

Also adds a CChunk default constructor to zero-initialise all members,
removes the redundant null guard in ~CChunk() (delete[] NULL is a
no-op), and fixes the m_pHead comment typo ("tails" → "head").

fix: remove dead m_Cookie field, fix whitespace, clarify bounds check

• Remove m_Cookie: initialized in the constructor but never read or
  written anywhere in the codebase; removed from both the header and the
  constructor.
• Whitespace: m_dwBufSize >> 1 → m_dwBufSize >> 1.
• Bounds check: restructure the POST body check from
  bodyLen <= m_dwRecv && bodyOffset <= m_dwRecv - bodyLen to
  bodyOffset <= m_dwRecv && bodyLen <= m_dwRecv - bodyOffset.
  The original is safe due to short-circuit evaluation, but the new form
  removes the subtle ordering dependency and reads more naturally as
  "offset fits, then length fits within the remainder".

Skipped findings

• Rename FindHeaderCaseInsensitive: anonymous-namespace function with
  a single call site searching for a header — the name accurately describes
  its use.
• Replace 0 with nullptr: the project consistently uses NULL/0
  throughout (~1400 occurrences vs ~20 nullptr); a two-line change would
  be inconsistent with the established style.