rowboat-server: WS auth token rides the URL as a query param

From PR #758 review. The /events WebSocket accepts ?token= as a fallback because browser WebSocket clients can't set headers. Query strings end up in access logs and proxy logs. The phone client uses the query param unconditionally even though React Native supports headers.

Fix: prefer the Authorization header wherever the client supports it (@x/client should switch), and consider a short-lived one-time ticket endpoint for browser clients before third-party UIs arrive.