fix: pass auth token via query param for SSE EventSource

EventSource API doesn't support custom headers, so pass token as
?token= query parameter. Server auth middleware now accepts token
from both Authorization header and query param.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/api/client.ts

@@ -6,7 +6,7 @@ function getBaseUrl(): string {
   return localStorage.getItem('hermes_server_url') || DEFAULT_BASE_URL
 }
 
-function getApiKey(): string {
+export function getApiKey(): string {
   return localStorage.getItem('hermes_api_key') || ''
 }