fix(serverdb): re-acquire the bearer token when a reconnect gets 401 (#39)

[thesprockee]

Summary

• Confirms and closes websocket_client: Authorization header is set once at Connect; reconnect with an expired token is unverified #39: the Authorization header is set once at Connect and never refreshed. ixwebsocket auto-reconnects by default and reuses the stored header on every retry (confirmed in vcpkg's ixwebsocket 11.4.6 source). An expired token means every reconnect gets HTTP 401 from Nakama (jwt.WithExpirationRequired, confirmed in the local nakama checkout) and nothing recovers it, since token-auth's refresh thread is skipped entirely in server mode (token_auth.cpp:906-911).
• Where it actually bites: with the default exit-on-error setting, Update() sees the disconnect and starts shutdown before a reconnect matters. The silent forever-401-retry case needs -noexitonerror, or a reconnect firing while Update() isn't being called (a documented level-transition gap at gameserver.cpp:1012).
• Fix: on a reconnect failure with HTTP 401 while a bearer token was in use, call a new AcquireServerDbToken() (extracted from RequestRegistration's existing refresh-then-password-auth logic, unchanged) and set the new header before the next attempt. Only 401 triggers it — network failures and 5xx don't hit the auth endpoint.

Test plan

• New test_websocket_client_auth (4 cases) against a scripted loopback server: no-refresher reuses stale token; 401 gets a new token on next attempt; 503 doesn't trigger a refresh; failed refresh keeps the old token and logs it
• Mutation checks: disabling the 401 hook fails 2 tests; firing on any HTTP error fails the 503 test
• just verify green (capped CMAKE_BUILD_PARALLEL_LEVEL=4)

Not done

• No live test holding a real game-server session past token expiry against production Nakama — the 401 path is proven against a scripted server only.

Found, not fixed here

• src/runtime/server/telemetry_streamer.cpp:41-51 has the identical set-once-header + auto-reconnect pattern (token from config's telemetry_token or a ServerDB-token fallback). Same class of bug, left out of scope — obvious follow-up.

🤖 Generated with Claude Code