fix: trim terminal bearer token so whitespace can't break the WebSocket (#25686)

A trailing space in the Open Terminal bearer token broke only the
interactive terminal: HTTP calls put the token in the Authorization
header, where the spec strips trailing whitespace, so the connection
test, file listing and tool calls all worked. The terminal WebSocket
can't set headers from the browser, so it sends the token inside a JSON
auth message that preserves the space verbatim, failing auth with
[Connection closed]. Normalize the key on save so whitespace never
enters storage, and trim it in the WebSocket auth message so existing
saved configs work without re-saving.


Fixes #25613

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lib/components/AddTerminalServerModal.svelte

@@ -260,6 +260,8 @@
 
 		// Remove trailing slash
 		url = url.replace(/\/$/, '');
+		// Bearer key whitespace breaks the terminal WebSocket auth (HTTP headers strip it, JSON doesn't)
+		key = key.trim();
 
 		// Save policy to orchestrator if applicable
 		let policyData = {};

src/lib/components/chat/XTerminal.svelte

@@ -106,7 +106,7 @@
 			ws.onopen = () => {
 				// First-message auth (no token in URL)
 				if (ws) {
-					ws.send(JSON.stringify({ type: 'auth', token: authToken }));
+					ws.send(JSON.stringify({ type: 'auth', token: authToken.trim() }));
 				}
 				connected = true;
 				connecting = false;