docs: clarify websocket auth flow

docs/getting-started.md

@@ -140,7 +140,9 @@ app.Run("http://localhost:7878")
 
 On the client side use `WebSocketClientTransport.connectAsync`, which
 opens a `ClientWebSocket`, attaches the bearer token (if any) as an
-`Authorization` header on the upgrade, and returns an `ITransport`:
+`Authorization` header on the upgrade, and returns an `ITransport`.
+That header is host-layer metadata; ARCP session authentication still
+comes from `ArcpClientOptions.Auth`:
 
 ```fsharp
 open ARCP.Client.Transport
@@ -152,7 +154,10 @@ task {
             (Some "demo")                       // bearer token, or None
             CancellationToken.None
 
-    let client = new ArcpClient(transport, ArcpClientOptions.defaults)
+    let client =
+        new ArcpClient(
+            transport,
+            { ArcpClientOptions.defaults with Auth = AuthScheme.Bearer "demo" })
     let! _session = client.ConnectAsync CancellationToken.None
     return client
 }

docs/transports.md

@@ -25,7 +25,9 @@ the paired `Receive` enumerator on the other side.
 `WebSocketClientTransport` wraps a `System.Net.WebSockets.WebSocket`.
 The convenience constructor `connectAsync` opens a `ClientWebSocket`,
 adds the bearer token (if any) as the `Authorization` header on the
-upgrade, and returns an `ITransport`:
+upgrade, and returns an `ITransport`. Treat that header as host-layer
+metadata; ARCP session authentication still comes from
+`ArcpClientOptions.Auth`:
 
 ```fsharp
 open ARCP.Client.Transport

src/Arcp.Client/Transport/WebSocket.fs

@@ -143,8 +143,9 @@ type WebSocketClientTransport(socket: WebSocket, ownsSocket: bool) =
 module WebSocketClientTransport =
     /// Connect a new client transport to `uri`. The bearer token (if
     /// provided) is added as the `Authorization` header on the
-    /// upgrade request — the runtime adapter authenticates against
-    /// the parsed `IPrincipal` rather than re-reading the header.
+    /// upgrade request. That header is host-layer metadata; ARCP
+    /// session authentication is configured separately on
+    /// `ArcpClientOptions`.
     let connectAsync (uri: Uri) (bearerToken: string option) (ct: CancellationToken) : Task<ITransport> =
         task {
             let client = new ClientWebSocket()