The terminal client passed the auth token as the WS subprotocol AND echoed
it in a second header, which some Chromium builds reject; and composition
events double-sent CJK input (each IME commit arrived once from the
composition handler and once from the data handler). One auth path, one
input path; also fixes the terminal-agent test that failed on clean main.
Contributed by @mindsurf0176 (PR #2515).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>