refactor(web): centralize dashboard websocket URL calls

Keep dashboard pages and components on the dashboard API helper instead of
calling the raw shared URL primitive directly. The shared helper remains the
single low-level implementation; web/src/lib/api.ts is the dashboard-specific
facade for auth, base path, and ticket minting.

web/src/components/ChatSidebar.tsx

@@ -26,13 +26,12 @@
 import { Button } from "@nous-research/ui/ui/components/button";
 import { Badge } from "@nous-research/ui/ui/components/badge";
 import { Card } from "@nous-research/ui/ui/components/card";
-import { buildHermesWebSocketUrl } from "@hermes/shared";
 
 import { ModelPickerDialog } from "@/components/ModelPickerDialog";
 import { ModelReloadConfirm } from "@/components/ModelReloadConfirm";
 import { ReasoningPicker } from "@/components/ReasoningPicker";
 import { GatewayClient, type ConnectionState } from "@/lib/gatewayClient";
-import { api, HERMES_BASE_PATH, buildWsAuthParam } from "@/lib/api";
+import { api, buildWsUrl } from "@/lib/api";
 import { titleFromSessionInfoPayload } from "@/lib/chat-title";
 
 import { cn } from "@/lib/utils";
@@ -231,18 +230,11 @@ export function ChatSidebar({
     let unmounting = false;
     let ws: WebSocket | null = null;
     void (async () => {
-      const authParam = await buildWsAuthParam();
-      if (!authParam[1] || unmounting) {
+      const url = await buildWsUrl("/api/events", { channel });
+      if (unmounting) {
         return;
       }
-      ws = new WebSocket(
-        buildHermesWebSocketUrl({
-          authParam,
-          basePath: HERMES_BASE_PATH,
-          params: { channel },
-          path: "/api/events",
-        }),
-      );
+      ws = new WebSocket(url);
 
       // `unmounting` suppresses the banner during cleanup — `ws.close()`
       // from the effect's return fires a close event with code 1005 that