Reject tail fetches for running WebSockets

[linkdata]

Closes #397.

Change

• Return 404 for a .tail fetch once its Request's WebSocket is running. The state check and queue drain share jw.mu, so a fetch started after that transition cannot consume live outbound updates.
• Keep pre-running tail fetches available.
• Clarify when TailHTML can apply initial updates.

Verification

• A real WebSocket regression test queues a class update while ConnectFn is paused. It checks that .tail returns 404 and the WebSocket receives the update. The test returned 200 before the fix.
• JAWS_REQUIRE_NODE=1 go test -race ./...
• go vet ./..., go build ./..., staticcheck ./..., gosec -quiet ./..., gofumpt -l ., and golangci-lint run via go run ...@v2.14.0.

The bundled client loads the parser-blocking tail script before its deferred script opens the WebSocket on DOMContentLoaded. A client that initiates both concurrently is out of scope. A failed pre-running tail write still cancels the Request because the one-shot drain has already removed its updates.