Authenticate sockets by header or one-time ticket instead of ?token=

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

worker/README.md

@@ -19,6 +19,9 @@ its own wheels without the engine ever installing them. Mint a token from the
 engine with `POST /api/v1/workers/tokens`; it carries this worker's name and
 labels, and `--labels` may repeat those but not change them.
 
+It sends the token as an `Authorization` header, which an engine from before
+that does not read: upgrade the engine first, then its workers.
+
 A plain `ws://` address is refused unless the engine is on this machine, since
 the token and node secrets would cross the network in clear; `--insecure`
 allows it on a network you trust.

worker/fluksio_worker/agent.py

@@ -156,8 +156,13 @@ class Agent:
                 backoff = min(MAX_BACKOFF_S, backoff * 2)
 
     async def _session(self) -> None:
-        url = f"{self.args.url}?token={self.args.token}"
-        async with websockets.connect(url, max_size=None, ping_interval=20) as socket:
+        # A header rather than the query string, which access logs keep.
+        async with websockets.connect(
+            self.args.url,
+            additional_headers={"Authorization": f"Bearer {self.args.token}"},
+            max_size=None,
+            ping_interval=20,
+        ) as socket:
             await socket.send(
                 json.dumps(
                     {

worker/pyproject.toml

@@ -22,7 +22,7 @@ classifiers = [
     "Topic :: System :: Distributed Computing",
 ]
 dependencies = [
-    "websockets>=12",
+    "websockets>=14",
 ]
 
 [project.urls]