Is the websocket connection opened directly from the client to the Postgres server? Or is the other end of the websocket tunnel terminated some sort of reverse proxy?

In that case, do you manage the possibility of multiple clients opening a websocket connection to the same to “the same” server (which may actually be a different instance of the same proxy)

Yes, you can. https://support.1password.com/create-share-vaults-teams/

That’s vault sharing, not password sharing.