fix: remove query-token auth from transcription stream

[sammargolis]

Summary

• removes URL query-token auth usage for hosted SSE transcription stream
• authenticates stream and uploads via HttpOnly cookie and bearer-header fallback
• updates client upload/stream plumbing to use credentials: include

Security impact

• eliminates token leakage risk via URL/history/referrer/logs
• keeps protected stream endpoint authorization intact

PHI handling impact

• no new PHI storage introduced
• reduces risk of auth token exposure in PHI-adjacent flows

Tests executed

• pnpm build:test
• pnpm exec tsc --project apps/web/tsconfig.json --noEmit

Rollback plan

• revert this PR to restore previous SSE auth transport behavior