fix: stabilize flaky server API and spread gate tests

Serialize agent WebSocket writes (ping + JSON), mutex-protect spreadGateClock,
and harden deploy-plan spread route hint setup under parallel test runs.

server/internal/api/websocket.go

@@ -108,6 +108,12 @@ func (c *AgentConnection) SendJSON(v interface{}) error {
 	return c.Conn.WriteJSON(v)
 }
 
+func (c *AgentConnection) WriteControl(messageType int, data []byte, deadline time.Time) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.Conn.WriteControl(messageType, data, deadline)
+}
+
 // DashboardConn wraps a dashboard WebSocket with its own write mutex so
 // broadcastDashboard and the ping loop never race on the same connection.
 type DashboardConn struct {
@@ -400,7 +406,7 @@ func (h *WSHub) runPingLoopAgent(ac *AgentConnection) {
 		ac.latencyMu.Lock()
 		ac.pingSentAt = time.Now()
 		ac.latencyMu.Unlock()
-		if err := conn.WriteControl(websocket.PingMessage, nil, time.Now().Add(10*time.Second)); err != nil {
+		if err := ac.WriteControl(websocket.PingMessage, nil, time.Now().Add(10*time.Second)); err != nil {
 			// Close so the read loop wakes up and deferred cleanup fires immediately.
 			_ = conn.Close()
 			return
@@ -877,7 +883,7 @@ func (h *WSHub) HandleAgentWS(w http.ResponseWriter, r *http.Request) {
 			go h.runPingLoopAgent(ac)
 		}
 
-		conn.WriteJSON(Message{Type: "auth_response", Payload: mustMarshal(func() map[string]interface{} {
+		_ = ac.SendJSON(Message{Type: "auth_response", Payload: mustMarshal(func() map[string]interface{} {
 			resp := map[string]interface{}{
 				"success":  true,
 				"agent_id": agentID,