Make the API token fully optional

The deploy job hard-failed without CRYPTO_API_TOKEN, and /api/ws (which skips
Basic auth) relied on that token. Drop the requirement: the app now works with
no token at all, matching the backend guard that was always a no-op when unset.
When a token is configured it still protects /api and /api/ws; when it is not,
/api/ws is as open as the rest of the API, which the Traefik Basic auth still
guards for everything else. Adds tests for the tokenless API and WebSocket.

README.md

@@ -136,9 +136,10 @@ auth, not instead of it.
 `/api/ws` is special: browsers do not reliably replay Basic-auth credentials on
 a WebSocket upgrade (which left the live feed stuck on "reconnecting"), so
 Traefik serves that one path on a separate higher-priority router **without**
-Basic auth. It is still gated by `API_TOKEN`, which nginx injects on the
-handshake. Because of this the deploy **requires** `CRYPTO_API_TOKEN` to be set —
-without it the WebSocket would be unauthenticated.
+Basic auth. If `API_TOKEN` is set, the WebSocket still requires it (nginx
+injects it on the handshake). If `API_TOKEN` is unset, `/api/ws` is as open as
+the rest of `/api`, which is fine for a trusted/private deployment but is the
+reason to set a token if the host is exposed.
 
 ## Risk controls