LicenseService: signed URL via ?key= instead of Authorization header

Apache FastCGI on OVH mutualisé strips Authorization headers before
PHP sees them. The mod_rewrite [E=HTTP_AUTHORIZATION:%1] workaround
in .htaccess does not survive on this hosting profile (probably
because rewrite runs after the FastCGI handler accepts the request).
The endpoint already accepts ?key= as a fallback path, so use that
from the client. HTTPS still protects the key on the wire and the
launcher never logs URLs containing the key.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/PSLauncher.Core/Licensing/LicenseService.cs

@@ -158,11 +158,14 @@ public sealed class LicenseService : ILicenseService
         var key = GetDecryptedKey();
         if (string.IsNullOrEmpty(key)) return null;
 
-        var url = TrimSlash(_serverBaseUrlProvider()) + "/download-url/" + version;
+        // On utilise ?key=… plutôt que le header Authorization parce que Apache OVH
+        // (et beaucoup de mutualisés FastCGI) strippe ce header avant qu'il atteigne
+        // PHP. La requête reste en HTTPS donc la clé n'est pas exposée sur le câble.
+        var encodedKey = Uri.EscapeDataString(key);
+        var url = TrimSlash(_serverBaseUrlProvider()) + "/download-url/" + version + "?key=" + encodedKey;
         try
         {
             using var req = new HttpRequestMessage(HttpMethod.Get, url);
-            req.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", key);
             using var resp = await _http.SendAsync(req, ct).ConfigureAwait(false);
             if (!resp.IsSuccessStatusCode)
             {