disconnected (1008): Invalid or missing token when using Cloudflare Access with custom domain

Problem

When using Cloudflare Access with a custom domain, the ?token= query parameter is stripped during the Access redirect, causing a 1008 "Invalid or missing token" error in the Chat UI.

Steps to reproduce

1. Deploy moltworker with Cloudflare Access enabled
2. Set MOLTBOT_GATEWAY_TOKEN as a secret
3. Configure a custom domain (e.g. moltbot.example.com) with Cloudflare Access
4. Visit https://moltbot.example.com/?token=YOUR_TOKEN
5. After Cloudflare Access authentication, the token is stripped from the URL
6. Chat UI shows: disconnected (1008): Invalid or missing token

Expected behavior

The token should be preserved after the Cloudflare Access redirect, or the UI should store the token in sessionStorage/localStorage before the redirect.

Environment

• Custom domain with Cloudflare Access (Azure AD / Entra ID)
• Workers Paid plan
• Latest version of moltworker (forked from cloudflare/moltworker)

Workaround

None found. The /_admin/ page works correctly with Cloudflare Access.