Refactor LLM API key handling for Ollama

The LLM client now conditionally adds the `Authorization` header only
when an API key is provided. The `llm_configured` check is updated to
reflect that an API key is not strictly required for Ollama-style
endpoints. A new integration test verifies the functionality against an
Ollama-compatible endpoint without an API key.

server/tests/analyze_test.rs

@@ -797,3 +797,91 @@ async fn bulk_reset_processes_multiple_cases_admin_only() {
     assert!(dir_c.join("document.md").exists());
     assert!(dir_c.join("2026-04-15T11-00-00Z.transcript.txt").exists());
 }
+
+// ---------------------------------------------------------------------
+// Ollama-style (no-auth) provider
+// ---------------------------------------------------------------------
+
+/// Proves the analysis pipeline works against an OpenAI-compatible endpoint
+/// that expects **no** Authorization header — i.e. Ollama's `/v1` surface.
+/// Guard mock (registered first, so wiremock picks it up for any request that
+/// actually carries the header) must stay at `.expect(0)`; happy mock takes
+/// all no-auth calls. This catches any future regression where the client
+/// accidentally sends `Authorization: Bearer `.
+#[tokio::test]
+async fn analyze_works_against_ollama_style_endpoint_without_api_key() {
+    let tmp = unique_tmp("ollama");
+    let case_dir = tmp.join("dr_a/22222222-2222-2222-2222-222222222222");
+    std::fs::create_dir_all(&case_dir).unwrap();
+
+    let input = json!({
+        "last_recording_mtime": "2026-04-16T10:00:00Z",
+        "recordings": [
+            { "recorded_at": "2026-04-16T10:00:00Z", "text": "Test." }
+        ]
+    });
+    std::fs::write(
+        case_dir.join("analysis_input.json"),
+        serde_json::to_vec_pretty(&input).unwrap(),
+    )
+    .unwrap();
+
+    let mock = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path("/v1/chat/completions"))
+        .and(wiremock::matchers::header_exists("authorization"))
+        .respond_with(ResponseTemplate::new(500))
+        .expect(0)
+        .mount(&mock)
+        .await;
+    Mock::given(method("POST"))
+        .and(path("/v1/chat/completions"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "choices": [{ "message": { "content": "# Doc via Ollama" } }]
+        })))
+        .expect(1)
+        .mount(&mock)
+        .await;
+
+    // Ollama-style config: explicitly empty api_key. Inline because
+    // `config_with_llm` hard-codes "test-key" for hosted-provider tests.
+    let users = vec![make_user("dr_a")];
+    let api_keys: HashMap<String, String> = users
+        .iter()
+        .map(|u| (u.api_key.clone(), u.slug.clone()))
+        .collect();
+    let config = Arc::new(Config {
+        data_path: tmp.clone(),
+        users,
+        api_keys,
+        llm_url: mock.uri(),
+        llm_api_key: String::new(),
+        llm_model: "llama3.3:70b".into(),
+        ..Config::test_default()
+    });
+
+    let (tx, rx) = analyze::channel();
+    let client = reqwest::Client::new();
+    let busy = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
+    let handle = tokio::spawn(analyze::worker::run(rx, config, client, busy));
+
+    tx.send(analyze::AnalyzeJob {
+        case_dir: case_dir.clone(),
+    })
+    .unwrap();
+
+    let document_path = case_dir.join("document.md");
+    let deadline = std::time::Instant::now() + Duration::from_secs(5);
+    while !document_path.exists() {
+        if std::time::Instant::now() > deadline {
+            panic!("document.md not written within 5s");
+        }
+        tokio::time::sleep(Duration::from_millis(20)).await;
+    }
+
+    let content = std::fs::read_to_string(&document_path).unwrap();
+    assert!(content.contains("Ollama"), "unexpected content: {content}");
+
+    drop(tx);
+    let _ = tokio::time::timeout(Duration::from_secs(2), handle).await;
+}