#1119 WS handshake accepts the token **only** as a URL query parameter

Problem Statement

swamp serve --auth-mode token authenticates the WebSocket handshake from
?token=<name>.<secret> in the request path. We probed all four plausible
transports against a live server:

| Transport | Result | g
| --- | --- | | no token | HTTP/1.1 401 Unauthorized | | GET /?token=… | HTTP/1.1 101 Switching Protocols | | Authorization: Bearer … | HTTP/1.1 401 Unauthorized | | Sec-WebSocket-Protocol: bearer.… | HTTP/1.1 401 Unauthorized |

Why this matters. Query strings are logged by default — reverse proxies (nginx $request_uri, envoy, ALB access logs), browser history, Referer headers, and shell history.

The asymmetry is notable: the documented REST endpoint (POST /api/v1/cancel/:type/:id) does take Authorization: Bearer. So the codebase already speaks header auth — just not at the WS upgrade.

Proposed Solution

Ask: accept Authorization: Bearer <token> on the WS upgrade request, and keep the query param as a deprecated fallback. Browsers can't set headers on new WebSocket(), so also consider the Sec-WebSocket-Protocol convention for browser clients.