[auth] Omit UNSIGNED self-call token in dev mode + video-engine test mypy fix

_agent_api_headers sent the UNSIGNED sentinel when ROBOCO_AGENT_AUTH_SECRET
was unset, but the dev-mode middleware rejects a presented-but-unverifiable
token with 401 signature mismatch (while accepting a missing one). The
cell-PM auto-submit self-call 401'd in every dev run, regressing
test_auto_submit_cuts_the_pm_turn. Attach the token only when a secret is
set. Also fix the FromClause.update mypy error in the per-project
video-engine opt-out test (ORM row load + flush).

tests/unit/services/test_video_engine.py

@@ -221,11 +221,10 @@ async def test_open_video_task_no_op_when_project_not_opted_in(
 ) -> None:
     await _seed(db_session)
     # Flip the per-project opt-in back off — the global flag stays on.
-    await db_session.execute(
-        ProjectTable.__table__.update()
-        .where(ProjectTable.__table__.c.slug == SLUG)
-        .values(video_engine_enabled=False)
-    )
+    project = (
+        await db_session.execute(select(ProjectTable).where(ProjectTable.slug == SLUG))
+    ).scalar_one()
+    project.video_engine_enabled = False
     await db_session.flush()
     _enable(monkeypatch)
     engine = video_engine_module.VideoEngine(db_session)