Omit Authorization header when API key is empty

Send no Authorization header at all on a fresh install (rather than
"Bearer " with an empty token), so the backend can distinguish "no
credentials supplied" from "credentials supplied but invalid".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/lib/utils/oott_api.dart

@@ -105,16 +105,20 @@ class BackendAPI {
         PrefUtil.getValue("base_url", "http://localhost:3000/api") as String;
     _apiKey = XOR().xorDecode(PrefUtil.getValue("api_key", "") as String);
 
+    final headers = <String, String>{
+      HttpHeaders.contentTypeHeader: 'application/json',
+    };
+    if (_apiKey.isNotEmpty) {
+      headers[HttpHeaders.authorizationHeader] = 'Bearer $_apiKey';
+    }
+
     _dio = Dio(
       BaseOptions(
         baseUrl: _baseUrl,
         connectTimeout: _connectTimeout,
         receiveTimeout: _receiveTimeout,
         sendTimeout: _sendTimeout,
-        headers: {
+        headers: headers,
-          HttpHeaders.contentTypeHeader: 'application/json',
-          HttpHeaders.authorizationHeader: 'Bearer $_apiKey',
-        },
       ),
     );
     _dio.interceptors.add(_buildRetryInterceptor(_dio));
@@ -127,16 +131,20 @@ class BackendAPI {
 
   // Returns null if the test was successful, and a String with a message about the issue if not
   static Future<String?> test(String baseUrl, String apiKey) async {
+    final headers = <String, String>{
+      HttpHeaders.contentTypeHeader: 'application/json',
+    };
+    if (apiKey.isNotEmpty) {
+      headers[HttpHeaders.authorizationHeader] = 'Bearer $apiKey';
+    }
+
     Dio dio = Dio(
       BaseOptions(
         baseUrl: baseUrl,
         connectTimeout: _connectTimeout,
         receiveTimeout: _receiveTimeout,
         sendTimeout: _sendTimeout,
-        headers: {
+        headers: headers,
-          HttpHeaders.contentTypeHeader: 'application/json',
-          HttpHeaders.authorizationHeader: 'Bearer $apiKey',
-        },
       ),
     );
     if (kDebugMode) {