Figured it out. Newest versions of war-based webapps do component scans automatically. Mine was not, because I had included this:
Do not include if you have tomcat included!
<dependency>
<groupId>javax.websocket</groupId>
<artifactId>javax.websocket-api</artifactId>
<version>1.0</version>
</dependency>
Reference on Websocket endpoints:
https://tyrus.java.net/documentation/1.3.3/index/deployment.html