fix(ui): keep auth tokens out of WebSocket connection logs

[blueberrycongee]

The WebSocket upgrade handler and the connection handler both log the full request URL. When local login is enabled (PILOTDECK_DISABLE_LOCAL_AUTH=0), the frontend passes the JWT as ?token= on /ws and /shell, so every connection and reconnect writes a reusable auth token to server output (and, for desktop runtimes with login enabled, to runtime.log). The rejected-token path logs it too, since logging happens before verification.

The query string adds nothing when debugging connections, since the path already shows which endpoint was hit, so this change logs only the path. Authentication behavior is unchanged, and the default no-login mode is unaffected because no token is sent there.