fix: Store username in gns3_ctx during auth, use for short-lived download JWTs

_ jw t_username_var set in _resolve_token for both JWT and API key auth.
Passed to handlers via gns3_ctx['jwt_username']. No raw key exposure,
no fake-user fallback.

gns3server/api/routes/mcp/links.py

@@ -191,15 +191,18 @@ def download_capture_file_handler(params: dict[str, Any], gns3_ctx: dict[str, An
     if not project_id or not link_id:
         return {"error": "project_id and link_id are required"}
     download_url = f"{gns3_ctx['server_url']}/v3/projects/{project_id}/links/{link_id}/capture/file"
-    # Generate a short-lived download token (10 min) so the user can curl without exposing their API key
-    download_token = auth_service.create_access_token("mcp-download", expires_in=10)
-    return {
+    # Short-lived JWT (10 min) — username stored during auth, never exposes raw key
+    username = gns3_ctx.get("jwt_username")
+    download_token = auth_service.create_access_token(username, expires_in=10) if username else None
+    result = {
         "link_id": link_id,
         "download_url": download_url,
-        "curl_command": f"curl -L -o capture.pcap -H 'Authorization: Bearer {download_token}' '{download_url}'",
-        "note": "This download link expires in 10 minutes. "
-                "The file is in pcap format and can be analyzed with Wireshark or tcpdump.",
+        "note": "The file is in pcap format and can be analyzed with Wireshark or tcpdump.",
     }
+    if download_token:
+        result["curl_command"] = f"curl -L -o capture.pcap -H 'Authorization: Bearer {download_token}' '{download_url}'"
+        result["note"] += " The download link includes a 10-minute token."
+    return result
 
 
 # ── Tool definitions ───────────────────────────────────────────────────────