matitos 2a88f55689 Make the API token fully optional ...

The deploy job hard-failed without CRYPTO_API_TOKEN, and /api/ws (which skips
Basic auth) relied on that token. Drop the requirement: the app now works with
no token at all, matching the backend guard that was always a no-op when unset.
When a token is configured it still protects /api and /api/ws; when it is not,
/api/ws is as open as the rest of the API, which the Traefik Basic auth still
guards for everything else. Adds tests for the tokenless API and WebSocket.

2026-09-19 14:31:42 +00:00

..

workflows

Make the API token fully optional

2026-09-19 14:31:42 +00:00