fix: issue short-lived console tickets instead of JWTs in node_console MCP tool

LLM clients transcribing the console WebSocket URL into shell commands
reliably corrupted the ~200-char JWT embedded in it (dropped header
segment -> "MissingAlgorithmError: Missing 'alg' value in header" on
every connection attempt). The node_console tool now mints a short
random ticket ("gns3t_" + 16 urlsafe chars, 10 min TTL, multi-use)
stored server-side and bound to the node's console endpoints:

- new ConsoleTicketService (gns3server/services/console_tickets.py),
  in-memory store with lazy expiry sweeps
- get_current_active_user_from_websocket redeems tickets through the
  existing "token" query parameter, gated on websocket.path_params so a
  ticket only authenticates the console/ws and console/vnc routes of
  the node it was minted for; the JWT path is unchanged
- redemption reuses the existing user lookup, token_version revocation
  and is_active checks, so logging out invalidates outstanding tickets
- vnc_url no longer embeds the full session JWT
- the tool docstring now tells clients to run the returned command
  verbatim instead of reconstructing the URL

gns3server/api/routes/controller/dependencies/authentication.py

@@ -29,7 +29,9 @@ import gns3server.db.models as models
 from gns3server.db.repositories.api_keys import ApiKeysRepository
 from gns3server.db.repositories.users import UsersRepository
 from gns3server.db.repositories.rbac import RbacRepository
-from gns3server.services import auth_service
+from gns3server.schemas.controller.tokens import TokenData
+from gns3server.services import auth_service, console_ticket_service
+from gns3server.services.console_tickets import TICKET_PREFIX
 from .database import get_repository
 
 log = logging.getLogger(__name__)
@@ -149,7 +151,25 @@ async def get_current_active_user_from_websocket(
     await websocket.accept(subprotocol=subprotocol)
 
     try:
-        token_data = auth_service.get_token_data(token)
+        if token.startswith(TICKET_PREFIX):
+            # Console tickets ("gns3t_…"): short-lived credentials bound to one
+            # node's console endpoints, minted by the node_console MCP tool.
+            # redeem() confines them to the route matching their binding, so
+            # they cannot authenticate the notification/wireshark sockets that
+            # share this dependency.
+            ticket = console_ticket_service.redeem(token, websocket.path_params)
+            if ticket is None:
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="Invalid or expired console ticket",
+                )
+            token_data = TokenData(
+                username=ticket.username,
+                token_version=ticket.token_version,
+                token_use="access",
+            )
+        else:
+            token_data = auth_service.get_token_data(token)
         _reject_refresh_token(token_data)
         user = await user_repo.get_user_by_username(token_data.username)