remove unused token query param fallback from WS auth

The ?token= fallback leaked JWTs in server logs and was never used by
the client, which always sends the token via WebSocket subprotocol
header.

daemon/server.py

@@ -372,7 +372,6 @@ async def _handle_ws(request: web.Request) -> web.Response:
     Authentication: JWT access token passed via:
     1. WebSocket subprotocol header (Sec-WebSocket-Protocol: "Bearer <token>")
     2. X-Auth-Token header (nginx-injected)
-    3. token query parameter (dev fallback)
     """
     from lib.auth import validate_token
 
@@ -388,9 +387,6 @@ async def _handle_ws(request: web.Request) -> web.Response:
     if token_param is None:
         token_param = request.headers.get("X-Auth-Token")
 
-    if token_param is None:
-        token_param = request.query.get("token")
-
     if token_param is None:
         return web.json_response(
             {"ok": False, "error": "authentication required"}, status=401