Add --debug flag for WebSocket connection diagnostics

Shows WS URL, auth headers (truncated), full handshake request/response.
Also improves the handshake failure error to include the raw server response.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/portainer_cli/commands/console.rb

@@ -13,9 +13,10 @@ module PortainerCli
     class Console
       include Base
 
-      def initialize(config, client)
+      def initialize(config, client, debug: false)
         @config = config
         @client = client
+        @debug  = debug
       end
 
       def run(args)
@@ -42,7 +43,7 @@ module PortainerCli
         send_resize(endpoint_id, exec_id) if $stdout.tty?
         trap('SIGWINCH') { send_resize(endpoint_id, exec_id) } if $stdout.tty?
 
-        WebsocketExec.new(ws_url, @config.auth_header, ssl_verify: @config.ssl_verify).run
+        WebsocketExec.new(ws_url, @config.auth_header, ssl_verify: @config.ssl_verify, debug: @debug).run
 
         $stderr.puts dim("\r\nSession ended.")
       rescue PortainerCli::Client::ApiError => e

lib/portainer_cli/commands/exec.rb

@@ -9,9 +9,10 @@ module PortainerCli
     class Exec
       include Base
 
-      def initialize(config, client)
+      def initialize(config, client, debug: false)
         @config = config
         @client = client
+        @debug  = debug
       end
 
       # portainer-cli exec <endpoint-id> <container-name-or-id> [-- cmd args...]
@@ -36,7 +37,7 @@ module PortainerCli
         send_resize(endpoint_id, exec_id) if $stdout.tty?
         trap('SIGWINCH') { send_resize(endpoint_id, exec_id) } if $stdout.tty?
 
-        WebsocketExec.new(ws_url, @config.auth_header, ssl_verify: @config.ssl_verify).run
+        WebsocketExec.new(ws_url, @config.auth_header, ssl_verify: @config.ssl_verify, debug: @debug).run
 
         $stderr.puts dim("\r\nSession ended.")
       rescue PortainerCli::Client::ApiError => e