mcp: fingerprint short-lived console tokens for copy-corruption checks

node_console_info now returns token_sha256_prefix (sha256, first 8 hex
chars) and token_ttl_seconds alongside the console WebSocket URL, and
controller WebSocket auth rejections include the sha256 prefix of the
token as received. Comparing the two immediately distinguishes a token
corrupted in transfer from server-side rejection causes (expired,
revoked, bad signature).

tests/api/routes/test_routes.py

@@ -106,7 +106,8 @@ class TestRoutes:
                     async with aconnect_ws(path, client, params=params) as ws:
                         json_notification = await ws.receive_json()
                         assert json_notification['event'] == {
-                            'message': 'Could not authenticate while connecting to controller WebSocket: Invalid token (DecodeError)'
+                            'message': 'Could not authenticate while connecting to controller WebSocket: '
+                                       'Invalid token (DecodeError) (received token sha256 prefix: 4d4f92fb)'
                         }