fix(ws-auth): only email and password are login credentials

auth.login passed its whole validated payload to Auth::attempt(). When the
client sent a stale bearer `token` next to email/password (an expired
session, or a token another app left on the same origin), the provider
turned it into `where token = ...` on users. That threw "Unknown column
'token'" and every correct password came back as invalid credentials.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/Websocket/Controllers/AuthController.php

@@ -57,8 +57,13 @@ class AuthController extends \BlaxSoftware\LaravelWebSockets\Websocket\Controlle
             }
         }
 
-        // Path 2: email + password → new token.
+        // Path 2: email + password → new token. Only these two keys are credentials:
-        if (! Auth::check() && isset($data['email'], $data['password']) && Auth::attempt($data)) {
+        // a stale `token` riding along would become `where token = …` on users.
+        if (
+            ! Auth::check()
+            && isset($data['email'], $data['password'])
+            && Auth::attempt(['email' => $data['email'], 'password' => $data['password']])
+        ) {
             $user = Auth::user();
 
             if (method_exists($user, 'createToken')) {