fix: issue short-lived console tickets instead of JWTs in node_console MCP tool

LLM clients transcribing the console WebSocket URL into shell commands
reliably corrupted the ~200-char JWT embedded in it (dropped header
segment -> "MissingAlgorithmError: Missing 'alg' value in header" on
every connection attempt). The node_console tool now mints a short
random ticket ("gns3t_" + 16 urlsafe chars, 10 min TTL, multi-use)
stored server-side and bound to the node's console endpoints:

- new ConsoleTicketService (gns3server/services/console_tickets.py),
  in-memory store with lazy expiry sweeps
- get_current_active_user_from_websocket redeems tickets through the
  existing "token" query parameter, gated on websocket.path_params so a
  ticket only authenticates the console/ws and console/vnc routes of
  the node it was minted for; the JWT path is unchanged
- redemption reuses the existing user lookup, token_version revocation
  and is_active checks, so logging out invalidates outstanding tickets
- vnc_url no longer embeds the full session JWT
- the tool docstring now tells clients to run the returned command
  verbatim instead of reconstructing the URL

gns3server/agent/mcp/__init__.py

@@ -557,21 +557,19 @@ async def node_console(
 ) -> list[dict[str, Any]]:
     """Get WebSocket console connection info for a node.
 
-    Returns the WebSocket URL, console type (telnet/ssh/vnc), and other
-    connection details needed to interact with a node's console via WebSocket.
-    The URL includes a short-lived JWT (10 min) — reconnect if it expires.
+    Returns the console type (telnet/ssh/vnc) and a ready-to-run websocat
+    command with a short-lived access token (10 min) already embedded.
 
-    Complete workflow:
-      1. Call this tool with project_id and node_id to get the WebSocket URL
-      2. Connect to the returned URL using websocat in text mode (-t):
-         > websocat -t --no-close "ws://<your-gns3-server-host>:3080/v3/projects/{project_id}/nodes/{node_id}/console/ws?token={jwt_token}"
-      3. Send device commands with \\r\\n line endings via heredoc:
-         > websocat -t --no-close "ws://..." <<< $'\\r\\nenable\\r\\nshow version\\r\\nexit\\r\\n'
-      4. Receive response: websocat receives and displays device output
-         Use 'timeout' to avoid connection hanging:
-         > timeout 10 websocat -t --no-close "ws://..." <<< $'commands\\r\\n'
+    IMPORTANT — copy the returned values EXACTLY:
+      - Run the returned "command" string verbatim; it already contains the
+        full URL with token. NEVER construct or edit the URL yourself, and
+        NEVER copy the token by hand — a mistyped token is rejected.
+      - The token expires after token_ttl_seconds (10 min): call this tool
+        again to get a fresh one; do not reuse an old URL.
+
+    Sending device commands after connecting:
+      > timeout 10 websocat -t --no-close "ws://..." <<< $'\\r\\nenable\\r\\nshow version\\r\\nexit\\r\\n'
 
-    Key points:
       - Use \\r\\n (not \\n) to match console protocol line endings
       - Use $'...' format for escape sequences in bash
       - --no-close keeps the WebSocket open after stdin (heredoc) hits EOF, so