Fix unhandled JSON.parse exception on WebSocket message crashes the server

[iaohkut-from-NightWolf-Team]

Fixes #151 (the crash portion — see note on scope below).

Summary

The live-reload WebSocket message handler called JSON.parse() on incoming frames with no try/catch. Combined with the WebSocketServer accepting connections from any origin, any web page open in another browser tab (or any other cross-origin client) could crash the dev server by opening a WebSocket to it and sending a single non-JSON frame.

Fix

ws.on("message", (data) => {
  let parsed;
  try {
    parsed = JSON.parse(data.toString());
  } catch(e) {
    return;
  }
  ...

Note on scope: #151 also flags the missing Origin validation on the WebSocket handshake as a contributing factor. I kept this fix scoped to the crash itself (which it fully closes on its own — no malformed message can bring the process down regardless of origin) rather than also adding origin-allowlisting, since the dev server has a documented showAllHosts option for legitimate multi-host/LAN access, and getting an origin allowlist right without breaking that felt like a design decision better left to a maintainer's judgment than bundled into a minimal security patch. Happy to follow up with an origin-check PR if that's wanted.

Verification

Full existing test suite: 32/32 passing, no regressions. PoC that previously crashed the server with a single malformed cross-origin WebSocket frame now leaves the server running normally.

See #151 for the full report and original reproduction.