Refactor LLM API key handling for Ollama

The LLM client now conditionally adds the `Authorization` header only
when an API key is provided. The `llm_configured` check is updated to
reflect that an API key is not strictly required for Ollama-style
endpoints. A new integration test verifies the functionality against an
Ollama-compatible endpoint without an API key.

server/src/analyze/llm.rs

@@ -74,6 +74,9 @@ struct ResponseMessage {
 
 /// Single-shot chat completion against an OpenAI-compatible endpoint.
 /// The `api_key` in `settings` is used as a Bearer token; do not log it.
+/// An empty `api_key` is treated as "no auth" — the `Authorization` header
+/// is omitted entirely, which is the correct mode for Ollama's
+/// OpenAI-compatible endpoint (some gateways object to a blank Bearer).
 pub async fn chat_once(
     client: &reqwest::Client,
     settings: &LlmSettings<'_>,
@@ -94,14 +97,11 @@ pub async fn chat_once(
         ],
     };
 
-    let response = client
-        .post(&url)
-        .bearer_auth(settings.api_key)
-        .timeout(timeout)
-        .json(&body)
-        .send()
-        .await
-        .map_err(LlmError::Http)?;
+    let mut req = client.post(&url).timeout(timeout).json(&body);
+    if !settings.api_key.is_empty() {
+        req = req.bearer_auth(settings.api_key);
+    }
+    let response = req.send().await.map_err(LlmError::Http)?;
 
     let status = response.status();
     if !status.is_success() {