Make the API token fully optional

The deploy job hard-failed without CRYPTO_API_TOKEN, and /api/ws (which skips
Basic auth) relied on that token. Drop the requirement: the app now works with
no token at all, matching the backend guard that was always a no-op when unset.
When a token is configured it still protects /api and /api/ws; when it is not,
/api/ws is as open as the rest of the API, which the Traefik Basic auth still
guards for everything else. Adds tests for the tokenless API and WebSocket.

AGENTS.md

@@ -164,10 +164,10 @@ real migration step.
   depend on `GuardedRuntimeDep`, not `RuntimeDep` (which no longer exists).
 - `/api/ws` skips Traefik Basic auth via a dedicated higher-priority router
   (`crypto-trading-ws`) because browsers don't reliably replay Basic creds on a
-  WS upgrade. The WS is gated by `API_TOKEN` instead (header, injected by nginx,
-  or `?token=` for manual clients) — see `websocket_endpoint`. The deploy job
-  fails closed if `CRYPTO_API_TOKEN` is unset. Keep the `/api/ws` block in
-  `nginx.conf` separate from `/api/` so upgrade headers are only set there.
+  WS upgrade. When `API_TOKEN` is set the WS requires it (header, injected by
+  nginx, or `?token=` for manual clients); when unset the path is open, matching
+  the rest of `/api`. `CRYPTO_API_TOKEN` is optional. Keep the `/api/ws` block
+  in `nginx.conf` separate from `/api/` so upgrade headers are only set there.
 
 ## Backtesting