Authenticate sockets by header or one-time ticket instead of ?token=

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

backend/tests/test_cli.py

@@ -1059,11 +1059,9 @@ def test_a_duration_reads_the_way_an_age_does() -> None:
 
 
 def test_the_dashboard_subscribes_where_the_browser_does() -> None:
-    """The same socket, and the token where a handshake can carry it."""
+    """The same socket, with the token kept out of its URL."""
     from fluksio.sdk.stream import socket_url
 
-    assert socket_url("http://127.0.0.1:8000", "abc") == (
-        "ws://127.0.0.1:8000/api/v1/flows/ws?token=abc"
-    )
+    assert socket_url("http://127.0.0.1:8000") == "ws://127.0.0.1:8000/api/v1/flows/ws"
     # TLS on the one side is TLS on the other.
-    assert socket_url("https://engine.example.com", "t").startswith("wss://")
+    assert socket_url("https://engine.example.com").startswith("wss://")