Portal link: send the instance credential as Authorization: Bearer

Not ?token= in the tunnel URL, which access logs keep. The hub has to be
upgraded first; websockets>=14 for additional_headers on the asyncio client.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

docs/interface/portal.md

@@ -49,6 +49,12 @@ Once enrolled, the instance appears under **Instances** with its
 status, when it was last seen and its version. **Open** takes you to its
 dashboard at `${DOMAIN}/i/{instance-id}`.
 
+**Upgrade a self-hosted portal before its instances.** An instance dials the
+tunnel with its credential in an `Authorization` header, where it stays out of
+access logs, and a portal from before that reads it only from the URL. The
+portal still takes the old `?token=` for one release, so older instances keep
+attaching meanwhile.
+
 ## What the portal can and cannot do
 
 The portal holds one credential for your instance and proxies requests down