Portal link: send the instance credential as Authorization: Bearer

Not ?token= in the tunnel URL, which access logs keep. The hub has to be
upgraded first; websockets>=14 for additional_headers on the asyncio client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

backend/tests/test_cloud.py

@@ -611,3 +611,33 @@ def test_the_tunnel_opens_the_live_socket_with_a_ticket(
     assert asyncio.run(opened())[0] == "ws_open_ok"
     # Used once: the same ticket again is refused.
     assert asyncio.run(opened()) == ["ws_close"]
+
+
+@pytest.mark.anyio
+async def test_the_link_sends_its_credential_as_a_header() -> None:
+    """Not in the URL, which access logs keep."""
+    import json
+    from types import SimpleNamespace
+
+    from websockets.asyncio.server import ServerConnection, serve
+
+    from fluksio.cloud.connector import CloudConnector
+
+    seen: dict[str, str | None] = {}
+
+    async def hub(socket: ServerConnection) -> None:
+        assert socket.request is not None
+        seen["path"] = socket.request.path
+        seen["auth"] = socket.request.headers.get("Authorization")
+        await socket.recv()
+        await socket.send(json.dumps({"op": "refused", "reason": "test hub"}))
+
+    async with serve(hub, "127.0.0.1", 0) as server:
+        port = next(iter(server.sockets)).getsockname()[1]
+        config = SimpleNamespace(
+            ws_url=f"ws://127.0.0.1:{port}/api/v1/tunnel/attach", token="t0k"
+        )
+        with pytest.raises(RuntimeError, match="test hub"):
+            await CloudConnector(Mock())._session(config)  # type: ignore[arg-type]
+
+    assert seen == {"path": "/api/v1/tunnel/attach", "auth": "Bearer t0k"}