fix: stop exposing JWT in WebSocket URL query param

Token was visible in server logs, browser history, and proxy access logs.
Backend now accepts the connection first, then validates a JSON auth
message {"token": "<jwt>"} sent by the client on open before adding
the socket to the active connections pool.

frontend/src/hooks/useStatusPolling.ts

@@ -24,11 +24,16 @@ export function useStatusPolling() {
 
     const protocol = window.location.protocol === 'https:' ? 'wss' : 'ws'
     const host = window.location.host  // includes port when non-standard
-    const url = `${protocol}://${host}/api/v1/status/ws/status?token=${encodeURIComponent(token)}`
+    const url = `${protocol}://${host}/api/v1/status/ws/status`
 
     const ws = new WebSocket(url)
     wsRef.current = ws
 
+    // Send token as first message (not in URL to avoid log/history exposure)
+    ws.onopen = () => {
+      ws.send(JSON.stringify({ token }))
+    }
+
     ws.onmessage = (event) => {
       try {
         const msg: StatusMessage = JSON.parse(event.data)