Remove token from WebSocket URL query parameters in ChallengeWebSocketService
and GameApiService. Instead, send {"type":"auth","token":"..."} as the first
text frame after the connection opens, matching the new backend auth protocol.
---------
Co-authored-by: LQ63 <lkhermann@web.de>
Reviewed-on: #13