Make the API token fully optional

The deploy job hard-failed without CRYPTO_API_TOKEN, and /api/ws (which skips
Basic auth) relied on that token. Drop the requirement: the app now works with
no token at all, matching the backend guard that was always a no-op when unset.
When a token is configured it still protects /api and /api/ws; when it is not,
/api/ws is as open as the rest of the API, which the Traefik Basic auth still
guards for everything else. Adds tests for the tokenless API and WebSocket.

frontend/nginx.conf

@@ -9,8 +9,8 @@ server {
     }
 
     # WebSocket feed. Kept in its own block so the upgrade headers are only set
-    # here, and so the API token is injected server-side on the handshake (the
-    # browser cannot set headers on a WebSocket).
+    # here, and so the optional API token is injected server-side on the
+    # handshake (the browser cannot set headers on a WebSocket).
     location /api/ws {
         proxy_pass http://backend:8000;
         proxy_http_version 1.1;