[auth] Omit UNSIGNED self-call token in dev mode + video-engine test mypy fix

_agent_api_headers sent the UNSIGNED sentinel when ROBOCO_AGENT_AUTH_SECRET
was unset, but the dev-mode middleware rejects a presented-but-unverifiable
token with 401 signature mismatch (while accepting a missing one). The
cell-PM auto-submit self-call 401'd in every dev run, regressing
test_auto_submit_cuts_the_pm_turn. Attach the token only when a secret is
set. Also fix the FromClause.update mypy error in the per-project
video-engine opt-out test (ORM row load + flush).

tests/unit/runtime/test_system_api_headers.py

@@ -82,3 +82,18 @@ def test_agent_api_headers_carry_signed_token_and_team(
     token = headers["X-Agent-Token"]
     assert token and token != "UNSIGNED"
     assert verify_agent_token(token, be_pm_uuid, role, team)
+
+
+def test_agent_api_headers_omit_token_when_secret_unset(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    # Dev mode: with no secret set, issue_agent_token returns the UNSIGNED
+    # sentinel, but the dev-mode middleware rejects a presented-but-unverifiable
+    # token with 401 "signature mismatch" while accepting a missing token.
+    # Sending UNSIGNED would 401 the cell-PM auto-submit self-call in every dev
+    # run (the e2e test_auto_submit_cuts_the_pm_turn regression), so the token
+    # header is omitted entirely when the secret is unset.
+    monkeypatch.delenv("ROBOCO_AGENT_AUTH_SECRET", raising=False)
+    be_pm = _foundation.AGENTS["be-pm"]
+    headers = _agent_api_headers(str(be_pm.uuid), be_pm.role.value)
+    assert "X-Agent-Token" not in headers

tests/unit/services/test_video_engine.py

@@ -221,11 +221,10 @@ async def test_open_video_task_no_op_when_project_not_opted_in(
 ) -> None:
     await _seed(db_session)
     # Flip the per-project opt-in back off — the global flag stays on.
-    await db_session.execute(
-        ProjectTable.__table__.update()
-        .where(ProjectTable.__table__.c.slug == SLUG)
-        .values(video_engine_enabled=False)
-    )
+    project = (
+        await db_session.execute(select(ProjectTable).where(ProjectTable.slug == SLUG))
+    ).scalar_one()
+    project.video_engine_enabled = False
     await db_session.flush()
     _enable(monkeypatch)
     engine = video_engine_module.VideoEngine(db_session)