fix(app): preserve auth token credentials

[kitlangton]

Summary

• Decode startup auth_token query credentials into the web app's server connection.
• Let token-derived credentials override persisted same-URL servers so protected URLs keep working after app boot.
• Preserve same-origin PTY auth only for token-derived credentials and strip auth_token from browser history after capture.

Testing

• bun test src/utils/server.test.ts src/utils/terminal-websocket-url.test.ts src/context/server.test.ts
• bun typecheck
• push hook: bun turbo typecheck