security: pass TLSYNC_SECRET token in sync WebSocket URI

Reads VITE_TLSYNC_SECRET from env and appends ?token=... to the
/connect/:roomId WebSocket URI so tlsync server can authenticate connections.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

src/services/tldraw/syncService.ts

@@ -72,8 +72,11 @@ export function createSyncConnectionOptions(options: SyncConnectionOptions) {
         roomId: effectiveRoomId
     });
 
+    const token = import.meta.env.VITE_TLSYNC_SECRET ?? ''
+    const tokenParam = token ? `?token=${encodeURIComponent(token)}` : ''
+
     return {
-        uri: `${baseUrl}/connect/${effectiveRoomId}`,
+        uri: `${baseUrl}/connect/${effectiveRoomId}${tokenParam}`,
         assets: multiplayerAssets,
         roomId: effectiveRoomId
     };
@@ -114,4 +117,3 @@ export function generateSharedRoomId(path: string): string {
     const sanitizedPath = path.replace(/[^a-zA-Z0-9]/g, '-');
     return `shared-${sanitizedPath}`;
 }
-