Make the API token fully optional

The deploy job hard-failed without CRYPTO_API_TOKEN, and /api/ws (which skips
Basic auth) relied on that token. Drop the requirement: the app now works with
no token at all, matching the backend guard that was always a no-op when unset.
When a token is configured it still protects /api and /api/ws; when it is not,
/api/ws is as open as the rest of the API, which the Traefik Basic auth still
guards for everything else. Adds tests for the tokenless API and WebSocket.

.env.example

@@ -44,8 +44,10 @@ MAX_POSITION_PCT=1.0
 MAX_TRADES_PER_DAY=0
 
 # --- API token (optional) ---
-# When set, /api requires this token. The frontend nginx injects it server-side,
-# so the browser never sees it. Leave empty to disable.
+# When set, /api and the /api/ws live feed require this token. The frontend
+# nginx injects it server-side, so the browser never sees it. Leave empty for
+# no token; the app works fully without it. (The Traefik Basic auth still
+# guards the UI in the deployed stack.)
 API_TOKEN=
 API_TOKEN_HEADER=X-API-Token