Remove token from WebSocket URL query parameters in ChallengeWebSocketService
and GameApiService. Instead, send {"type":"auth","token":"..."} as the first
text frame after the connection opens, matching the new backend auth protocol.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>