Make the API token fully optional

The deploy job hard-failed without CRYPTO_API_TOKEN, and /api/ws (which skips
Basic auth) relied on that token. Drop the requirement: the app now works with
no token at all, matching the backend guard that was always a no-op when unset.
When a token is configured it still protects /api and /api/ws; when it is not,
/api/ws is as open as the rest of the API, which the Traefik Basic auth still
guards for everything else. Adds tests for the tokenless API and WebSocket.

docker-compose.yml

@@ -98,10 +98,9 @@ services:
       - "traefik.http.middlewares.crypto-trading-auth.basicauth.users=${CRYPTO_FRONTEND_AUTH_USERS:?CRYPTO_FRONTEND_AUTH_USERS is required (htpasswd string, e.g. htpasswd -nbB user pass)}"
       # Browsers do not reliably replay Basic-auth credentials on a WebSocket
       # upgrade, which left the live feed stuck "reconnecting". Give /api/ws its
-      # own higher-priority router that skips Basic auth; the backend still
-      # requires the API token, which nginx injects server-side. When no API
-      # token is configured this path is unauthenticated, so only use it on a
-      # trusted network.
+      # own higher-priority router that skips Basic auth so the feed connects.
+      # If CRYPTO_API_TOKEN is set, the backend still requires it (nginx injects
+      # it server-side); if it is unset, /api/ws is as open as the rest of /api.
       - "traefik.http.routers.crypto-trading-ws.rule=Host(`crypto.${BASE_DOMAIN:-matitos.org}`) && PathPrefix(`/api/ws`)"
       - "traefik.http.routers.crypto-trading-ws.entrypoints=websecure"
       - "traefik.http.routers.crypto-trading-ws.tls.certresolver=myresolvercd"