Make the API token fully optional

The deploy job hard-failed without CRYPTO_API_TOKEN, and /api/ws (which skips
Basic auth) relied on that token. Drop the requirement: the app now works with
no token at all, matching the backend guard that was always a no-op when unset.
When a token is configured it still protects /api and /api/ws; when it is not,
/api/ws is as open as the rest of the API, which the Traefik Basic auth still
guards for everything else. Adds tests for the tokenless API and WebSocket.

backend/tests/test_api.py

@@ -145,6 +145,29 @@ def test_api_token_enforced(runtime: Runtime) -> None:
         assert client.get("/api/health").status_code == 200
 
 
+def test_websocket_connects_without_any_token(runtime: Runtime) -> None:
+    # API_TOKEN is unset by default: the API and the live feed must work with no
+    # token at all, even when (as nginx does) an empty token header is sent.
+    runtime.settings.api_token = ""
+    app = create_app(runtime.settings, runtime)
+    with (
+        TestClient(app) as client,
+        client.websocket_connect("/api/ws", headers={"X-API-Token": ""}) as websocket,
+    ):
+        message = websocket.receive_json()
+        assert message["type"] == "status"
+        assert message["data"]["running"] is False
+
+
+def test_api_works_without_token(runtime: Runtime) -> None:
+    runtime.settings.api_token = ""
+    app = create_app(runtime.settings, runtime)
+    with TestClient(app) as client:
+        assert client.get("/api/status").status_code == 200
+        assert client.get("/api/strategies").status_code == 200
+        assert client.post("/api/backtest", json={"strategy_key": "sma_cross"}).status_code != 401
+
+
 def test_websocket_rejects_missing_token(runtime: Runtime) -> None:
     runtime.settings.api_token = "secret"
     app = create_app(runtime.settings, runtime)