Serve /api/ws without Basic auth so the live feed connects

Browsers don't reliably replay Basic-auth credentials on a WebSocket upgrade,
so the dashboard's live feed was stuck on "reconnecting" (only the 5s REST
poll worked). Give /api/ws a higher-priority Traefik router that skips Basic
auth; the backend still requires API_TOKEN, which nginx injects on the
handshake. The deploy now fails closed unless CRYPTO_API_TOKEN is set.

Also: split the nginx /api/ws block so upgrade headers are only set there, and
add reconnect backoff (2s -> 30s) so a failing socket stops hammering.

AGENTS.md

@@ -162,6 +162,12 @@ real migration step.
   frontend nginx injects it via the `API_TOKEN_HEADER` header on `/api`, and on
   the WebSocket upgrade. `GET /api/health` is always open. When adding routes,
   depend on `GuardedRuntimeDep`, not `RuntimeDep` (which no longer exists).
+- `/api/ws` skips Traefik Basic auth via a dedicated higher-priority router
+  (`crypto-trading-ws`) because browsers don't reliably replay Basic creds on a
+  WS upgrade. The WS is gated by `API_TOKEN` instead (header, injected by nginx,
+  or `?token=` for manual clients) — see `websocket_endpoint`. The deploy job
+  fails closed if `CRYPTO_API_TOKEN` is unset. Keep the `/api/ws` block in
+  `nginx.conf` separate from `/api/` so upgrade headers are only set there.
 
 ## Backtesting