llama-cpp: add API key auth via --api-key-file

Generate and encrypt a Bearer token for llama-cpp's built-in auth.
Remove caddy_auth from the vhost since basic auth blocks Bearer-only
clients. Internal sidecars (xmrig-pause, annotations) connect
directly to localhost and are unaffected (/slots is public).

services/disk-usage-collector.sh

@@ -31,7 +31,7 @@ TMP="${TEXTFILE}.$$"
   # Use df with 1K blocks and convert to bytes
   for mount in /boot /persistent /nix; do
     if mountpoint -q "$mount" 2>/dev/null; then
-      read -r size used avail _ <<< $(df -k --output=size,used,avail "$mount" | tail -1)
+      read -r size used avail _ <<< "$(df -k --output=size,used,avail "$mount" | tail -1)"
       size_b=$((size * 1024))
       used_b=$((used * 1024))
       avail_b=$((avail * 1024))