fix: WebSocket 鉴权 — Cookie 优先 (支持 HttpOnly)

根因: panel_token 是 HttpOnly cookie, JS getCookie() 读不到
→ 前端 WS ?token= 参数为空 → 认证失败 → 仪表盘无数据

修复:
- _ws_auth_wrapper: Cookie 优先 → query token 备用 → API Key
- 浏览器同源 WS 自动发送 Cookie, 无需 ?token=
- dashboard.js / logs.js 移除多余的 getCookie+?token=

Co-Authored-By: Claude <noreply@anthropic.com>

static/web_panel/pages/dashboard.js

@@ -32,8 +32,7 @@ window.DashboardModule = {
         }
 
         var base = window.location.pathname.split("/").slice(0, 2).join("/");
-        var tok = getCookie("panel_token");
-        var ws = new WebSocket("ws://" + location.host + base + "/api/system/ws?token=" + (tok || ""));
+        var ws = new WebSocket("ws://" + location.host + base + "/api/system/ws");
         self.ws = ws;
 
         ws.onopen = function() {

static/web_panel/pages/logs.js

@@ -25,8 +25,7 @@ window.LogsModule = {
         }
 
         var base = window.location.pathname.split("/").slice(0, 2).join("/");
-        var tok = getCookie("panel_token");
-        var ws = new WebSocket("ws://" + location.host + base + "/api/logs/ws?token=" + (tok || ""));
+        var ws = new WebSocket("ws://" + location.host + base + "/api/logs/ws");
         self.ws = ws;
 
         ws.onopen = function() {