Serve /api/ws without Basic auth so the live feed connects

Browsers don't reliably replay Basic-auth credentials on a WebSocket upgrade,
so the dashboard's live feed was stuck on "reconnecting" (only the 5s REST
poll worked). Give /api/ws a higher-priority Traefik router that skips Basic
auth; the backend still requires API_TOKEN, which nginx injects on the
handshake. The deploy now fails closed unless CRYPTO_API_TOKEN is set.

Also: split the nginx /api/ws block so upgrade headers are only set there, and
add reconnect backoff (2s -> 30s) so a failing socket stops hammering.

.gitea/workflows/deploy.yml

@@ -147,6 +147,14 @@ jobs:
             echo "::error::CRYPTO_FRONTEND_AUTH_USERS is not set (repo/org variable or secret); refusing to deploy"
             exit 1
           fi
+          # /api/ws bypasses Basic auth (browsers don't reliably replay
+          # credentials on a WebSocket upgrade) and relies on the API token
+          # instead. Refuse to ship if that token is missing, or the live feed
+          # would be unauthenticated.
+          if [ -z "$CRYPTO_API_TOKEN" ]; then
+            echo "::error::CRYPTO_API_TOKEN must be set because /api/ws skips Basic auth; refusing to deploy"
+            exit 1
+          fi
 
       - name: Log in to Docker Hub (optional)
         run: |