Authenticate sockets by header or one-time ticket instead of ?token=

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

backend/fluksio/cloud/connector.py

@@ -522,13 +522,18 @@ class CloudConnector:
             panel_scope,
             snapshot_payload,
         )
+        from fluksio.api.socket_auth import redeem_ticket
         from fluksio.core.db import engine
         from fluksio.flow.events import event_bus
 
         stream_id = str(frame["id"])
         path = str(frame.get("path") or "")
         query = str(frame.get("query") or "")
-        token = _query_value(query, "token")
+        # The browser's ticket when it brought one; the hub restates the
+        # session it checked as `token` either way, which is the tunnel's own
+        # channel and stays when the public `?token=` goes.
+        ticket = _query_value(query, "ticket")
+        token = redeem_ticket(ticket) if ticket else _query_value(query, "token")
 
         if not path.startswith(ALLOWED_PREFIX) or not path.endswith("/flows/ws"):
             await socket.send(_dump({"op": "ws_close", "id": stream_id, "code": 1008}))