Fix clw-auth-disconnected: Resolve OpenClaw authentication disconnection during sessions

Symptoms include:

- Abrupt session termination after initial auth success.
- Failed API calls returning 503-like responses with auth context.
- Network traces showing TCP RST or FIN-ACK from server post-auth packet.
- Client-side: `ClwAuthHandle` becomes invalid, `clw_auth_status()` returns `CLW_AUTH_DISCONNECTED`.
- High-frequency occurrences under load, e.g., >100 concurrent sessions.
- No data corruption; pure auth-layer disconnect.

Repro steps: Run OpenClaw client against a loaded server, simulate 5-10s latency spikes. Error rate spikes to 40% on unstable networks.

Logs often pair with:

Impacts multiplayer games using OpenClaw for Claw server auth, causing player kicks.

## 2. Root Cause

`clw-auth-disconnected` triggers when the OpenClaw auth stream (built on WebSocket-like CLW protocol) closes without graceful `CLW_AUTH_LOGOUT`. Core causes:

1. **Network Instability**: Packet loss >2% or jitter >500ms drops the auth heartbeat. OpenClaw requires <1s roundtrips for auth pings.
2. **Token Expiry/Mismatch**: Auth tokens expire (default 5min TTL) without refresh. Server rejects stale `CLW_AUTH_PING` payloads.
3. **Server Overload**: Auth server queue overflows (>1024 pending), forcing disconnects via `clw_server_disconnect_auth()`.
4. **Client-Side Bugs**: Missing `clw_auth_heartbeat()` calls or unhandled `CLW_EV_AUTH_PONG` events.
5. **Firewall/NAT Issues**: UDP hole punching fails for CLW's hybrid TCP/UDP auth, causing one-way disconnects.
6. **Version Mismatch**: Client libclw.so v2.1.4 vs server v2.2.0; auth proto changed in 2.2.

From OpenClaw source (`clw_auth.c:handle_disconnect()`), error fires on `recv()` EOF or `CLW_DISCONNECT_AUTH` opcode (0xA03). Strace shows `ECONNRESET` on FD 7 (auth sock).

Root trace: `gdb` on client reveals `clw_auth_poll()` stuck in `select()` >10s, then `EPOLLHUP`.

## 3. Step-by-Step Fix

Fix requires robust reconnection, heartbeat enforcement, and token refresh. Update OpenClaw client code.

### Step 1: Enable Auth Retries and Heartbeat
Configure `ClwAuthConfig` with retry limits.

```c
// Before: No retries, default timeouts
ClwAuthConfig cfg = {0};
cfg.timeout_ms = 5000;
clw_auth_init(&handle, &cfg);

// After: Retries=3, heartbeat=2s
ClwAuthConfig cfg = {
    .timeout_ms = 3000,
    .heartbeat_ms = 2000,
    .max_retries = 3,
    .reconnect_backoff = 1000  // ms exponential
};
clw_auth_init(&handle, &cfg);

// Vulnerable: No reconnect, blocks forever
while (running) {
    ClwEvent ev;
    if (clw_auth_poll(handle, &ev, 5000) == CLW_OK) {
        if (ev.type == CLW_EV_AUTH_PONG) {
            // Assume connected
        }
    } else {
        fprintf(stderr, "Auth poll failed\n");
        break;  // Fatal exit
    }
}
clw_auth_cleanup(&handle);

// Robust: Reconnect on disconnect
int reconnect_attempts = 0;
while (running && reconnect_attempts < 5) {
    ClwEvent ev;
    int ret = clw_auth_poll(handle, &ev, cfg.heartbeat_ms);
    if (ret == CLW_OK) {
        switch (ev.type) {
            case CLW_EV_AUTH_PONG:
                reconnect_attempts = 0;  // Reset
                break;
            case CLW_EV_AUTH_REFRESH_NEEDED:
                clw_auth_refresh_token(handle, new_token);
                break;
        }
    } else if (ret == CLW_ERR_DISCONNECTED || clw_auth_status(handle) == CLW_AUTH_DISCONNECTED) {
        if (++reconnect_attempts > cfg.max_retries) {
            fprintf(stderr, "Max retries exceeded\n");
            break;
        }
        clw_auth_reconnect(handle);  // Internal backoff
        usleep(cfg.reconnect_backoff * reconnect_attempts);
    }
}
if (!running) clw_auth_cleanup(&handle);

// No refresh logic
static void on_token_expire(ClwAuthHandle h) {
    // Ignored
}

// Auto-refresh 30s before expiry
static void token_refresh_cb(ClwAuthHandle h, void* user) {
    char* new_token = generate_auth_token(user_data);
    if (clw_auth_update_token(h, new_token, strlen(new_token)) != CLW_OK) {
        clw_auth_reconnect(h);
    }
    free(new_token);
}

ClwAuthConfig cfg = { ... };
cfg.token_ttl_s = 300;  // 5min
cfg.refresh_cb = token_refresh_cb;
cfg.user_data = my_user_ctx;

// server/main.c
clw_server_config.auth_queue_max = 2048;  // Up from 1024
clw_server_config.heartbeat_grace = 5000;  // ms

int keepalive = 1;
setsockopt(clw_auth_fd(handle), SOL_SOCKET, SO_KEEPALIVE, &keepalive, sizeof(keepalive));
int idle = 10;  // 10s
setsockopt(clw_auth_fd(handle), IPPROTO_TCP, TCP_KEEPIDLE, &idle, sizeof(idle));