fix(docker): enforce JWT on job endpoints instead of 500 (resolve credentials correctly)

[jacksimplified]

What & why

Fixes #1996.

The job router wires its auth dependency as Depends(lambda: _token_dep()). Wrapping the dependency in a lambda prevents FastAPI from resolving the Bearer credentials sub-dependency declared inside jwt_required, so verify_token receives a Depends object and raises AttributeError → HTTP 500 whenever security.jwt_enabled is true. This affects all four job endpoints (/llm/job, /llm/job/{id}, /crawl/job, /crawl/job/{id}) for every request, with or without a token, making them unusable. With jwt_enabled: false the bug is masked because _token_dep is lambda: None.

Change

Replace the broken lambda with a module-level dependency _job_token_dep that mirrors auth.get_token_dependency:

• declares credentials properly (via HTTPBearer(auto_error=False)) so FastAPI resolves the Bearer header,
• enforces a valid token when jwt_enabled is true (401 otherwise),
• is a no-op when jwt_enabled is false,
• reads jwt_enabled from the injected _config, preserving the existing late-binding via init_job_router.

The four Depends(lambda: _token_dep()) are replaced with Depends(_job_token_dep).

Verified behavior (on the published image)

jwt_enabled: true:

Request	Before	After
POST /llm/job no token	500	401
POST /crawl/job no token	500	401
POST /llm/job invalid token	500	401
POST /llm/job valid token	500	202 (auth passes)
POST /md no token (control)	401	401

jwt_enabled: false:

Request	Before	After
POST /llm/job no token	202	202 (no regression)