fix(server): omit Authorization header on peer-proxy when caller provides no key

`_proxy_to_peer` set `"Authorization": ""` when `api_key` was empty — a
blank-value header, not a missing one.  Many HTTP proxies and uvicorn
front-ends (nginx, traefik) reject `Authorization: ""` with 400 Bad
Request, breaking peer routing for anonymous requests to public hubs.

Fix: build the headers dict without the Authorization key and add it only
when `api_key` is non-empty, matching the correct "omit, don't blank"
contract for optional bearer tokens.

Author: Zawwarsami16

zhub/server.py

@@ -1220,11 +1220,12 @@ async def _proxy_to_peer(peer_url: str, ai_name: str, body: dict[str, Any],
 
         target = peer_url.rstrip("/") + f"/{ai_name}/v1/chat/completions"
         chain_str = ",".join(forwarded_by_chain)
-        headers = {
-            "Authorization": f"Bearer {api_key}" if api_key else "",
+        headers: dict[str, str] = {
             "X-Zhub-Forwarded-By": chain_str,
             "Content-Type": "application/json",
         }
+        if api_key:
+            headers["Authorization"] = f"Bearer {api_key}"
         # Phase 17.0: sign the chain so the receiving hub can verify the
         # request really originated where it claims. Best-effort —
         # silently skipped if crypto isn't installed (recipient sees no