Authenticate sockets by header or one-time ticket instead of ?token=

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

backend/tests/api/routes/test_flows.py

@@ -521,6 +521,7 @@ async def test_the_live_socket_ends_when_its_client_goes(
 
         def __init__(self) -> None:
             self.app = client.app
+            self.headers: dict[str, str] = {}
             self.frames = ['{"type": "media", "names": []}']
             self.sent: list[str] = []