security(server/client): pass WebSocket API key via X-Api-Key header instead of URL query string

[amir-rezaei]

Description

This PR resolves issue #1152 by updating the server and client to transport the WebSocket API key via the X-Api-Key HTTP header instead of logging credentials in the URL query string.

Details

• Previously, credentials traveled as /ws?token=sk-xxx, causing server logs (e.g. uvicorn access logs) and reverse proxies to record secret API keys verbatim in cleartext.
• Server (taskdog-server): Accepts the API key from the X-Api-Key header while keeping the query parameter token as a fallback for backwards compatibility.
• Client (taskdog-client): Sends the API key via extra_headers using the X-Api-Key header during the WebSocket handshake.

[Kohei-Wada]

Thanks for the contribution, but CI is failing on this PR (Type Check), and no fix has been pushed.

Closing to keep the review queue actionable. Please feel free to reopen once:

• all required checks pass on your branch, and
• the change is covered by tests that pass locally (make check && make test).

A PR that fails its own package's test suite can't be reviewed on its merits, so please verify locally before opening.