Serve /api/ws without Basic auth so the live feed connects

Browsers don't reliably replay Basic-auth credentials on a WebSocket upgrade,
so the dashboard's live feed was stuck on "reconnecting" (only the 5s REST
poll worked). Give /api/ws a higher-priority Traefik router that skips Basic
auth; the backend still requires API_TOKEN, which nginx injects on the
handshake. The deploy now fails closed unless CRYPTO_API_TOKEN is set.

Also: split the nginx /api/ws block so upgrade headers are only set there, and
add reconnect backoff (2s -> 30s) so a failing socket stops hammering.

README.md

@@ -133,6 +133,13 @@ open). The frontend nginx injects it server-side, so the browser never sees it
 and the dashboard keeps working unchanged. This sits *behind* the Traefik Basic
 auth, not instead of it.
 
+`/api/ws` is special: browsers do not reliably replay Basic-auth credentials on
+a WebSocket upgrade (which left the live feed stuck on "reconnecting"), so
+Traefik serves that one path on a separate higher-priority router **without**
+Basic auth. It is still gated by `API_TOKEN`, which nginx injects on the
+handshake. Because of this the deploy **requires** `CRYPTO_API_TOKEN` to be set —
+without it the WebSocket would be unauthenticated.
+
 ## Risk controls
 
 The engine enforces limits on every tick and **halts + flattens** when one trips: