fix: nginx injects Authorization header for canvas auth

Dockerfile

@@ -13,7 +13,7 @@ RUN curl -fsSL https://ollama.com/install.sh | sh
 
 RUN pip3 install --no-cache-dir --break-system-packages huggingface_hub
 
-RUN printf 'server {\n    listen 7860;\n    location /__openclaw__/ {\n        proxy_pass http://127.0.0.1:8081;\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection "upgrade";\n        proxy_set_header Host $host;\n    }\n    location /api/ {\n        proxy_pass http://127.0.0.1:8081;\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection "upgrade";\n        proxy_set_header Host $host;\n    }\n    location /health {\n        proxy_pass http://127.0.0.1:8081;\n        proxy_set_header Host $host;\n    }\n    location / {\n        proxy_pass http://127.0.0.1:8080;\n        proxy_set_header Host $host;\n    }\n}\n' > /etc/nginx/sites-available/default
+RUN printf 'server {\n    listen 7860;\n    set $auth_header "";\n    if ($arg_token) {\n        set $auth_header "Bearer $arg_token";\n    }\n    location /__openclaw__/ {\n        proxy_pass http://127.0.0.1:8081;\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection "upgrade";\n        proxy_set_header Host $host;\n        proxy_set_header Authorization $auth_header;\n    }\n    location /api/ {\n        proxy_pass http://127.0.0.1:8081;\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection "upgrade";\n        proxy_set_header Host $host;\n        proxy_set_header Authorization $auth_header;\n    }\n    location /health {\n        proxy_pass http://127.0.0.1:8081;\n        proxy_set_header Host $host;\n        proxy_set_header Authorization $auth_header;\n    }\n    location / {\n        proxy_pass http://127.0.0.1:8080;\n        proxy_set_header Host $host;\n    }\n}\n' > /etc/nginx/sites-available/default
 
 WORKDIR /app
 COPY . .