fix(render): issue short-lived WebUI tokens via tokenIssueSecret

Map NANOBOT_WEB_TOKEN to channels.websocket.tokenIssueSecret instead of
the static token, and remove the static token. The gateway now issues
short-lived WebSocket/API tokens rather than accepting a long-lived
credential directly at the handshake, matching the public-WebUI login
flow and documentation. Users still enter the same NANOBOT_WEB_TOKEN,
and websocketRequiresToken remains true.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

render-config.json

@@ -19,7 +19,7 @@
       "enabled": true,
       "host": "0.0.0.0",
       "port": 8765,
-      "token": "${NANOBOT_WEB_TOKEN}",
+      "tokenIssueSecret": "${NANOBOT_WEB_TOKEN}",
       "websocketRequiresToken": true
     }
   },