Phase 5A: implement tenant auth foundation across broker, app, and agent

agent/main.go

@@ -11,6 +11,7 @@ import (
 	"net"
 	"net/http"
 	"net/netip"
+	"net/url"
 	"os"
 	"path/filepath"
 	"sort"
@@ -917,13 +918,17 @@ func main() {
 
 	go state.startHTTPServer(cfg.AllowedSubnets)
 
-	conn, _, err := websocket.DefaultDialer.Dial(brokerURL, nil)
+	wsURL := brokerURL
+	if state.token != "" {
+		wsURL = brokerURL + "?token=" + url.QueryEscape(state.token)
+	}
+	conn, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
 	if err != nil {
 		log.Fatal("connect:", err)
 	}
 	defer conn.Close()
 	state.setConnected(true)
-	log.Println("connected to broker at", brokerURL)
+	log.Println("connected to broker at", wsURL)
 	hello, _ := json.Marshal(Message{
 		Type:         "agent_hello",
 		LANEndpoints: getLANEndpoints(cfg.BindHost, cfg.BindPort),