fix: add Bearer auth to capture sidecar callback and pass CAPTURE_TOKEN

- capture/src/index.js: read MAM_API_TOKEN from env; include
  Authorization: Bearer header in shutdown callback fetches to mam-api
  (POST /assets and POST /assets/:id/mark-empty). Without this, mam-api
  AUTH_ENABLED=true rejects the callback with 401, leaving assets stuck in live
- recorders.js: pass MAM_API_TOKEN=${CAPTURE_TOKEN} in sidecar env so the
  capture container receives the token at boot
- api_tokens: inserted capture-sidecar token (unbound, prefix b3d3d3c4)

services/capture/src/index.js

@@ -9,6 +9,7 @@ dotenv.config();
 const app = express();
 const PORT = process.env.PORT || 3001;
 const MAM_API_URL = process.env.MAM_API_URL || 'http://mam-api:3000';
+const MAM_API_TOKEN = process.env.MAM_API_TOKEN || '';
 
 app.use(cors());
 app.use(express.json());
@@ -128,7 +129,7 @@ async function gracefulShutdown(signal) {
           try {
             await fetch(`${MAM_API_URL}/api/v1/assets/${liveAssetId}/mark-empty`, {
               method: 'POST',
-              headers: { 'Content-Type': 'application/json' },
+              headers: { 'Content-Type': 'application/json', ...(MAM_API_TOKEN ? { 'Authorization': `Bearer ${MAM_API_TOKEN}` } : {}) },
             });
           } catch (e) {
             console.error('[shutdown] failed to flag empty asset:', e.message);
@@ -138,7 +139,7 @@ async function gracefulShutdown(signal) {
         try {
           const res = await fetch(`${MAM_API_URL}/api/v1/assets`, {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
+            headers: { 'Content-Type': 'application/json', ...(MAM_API_TOKEN ? { 'Authorization': `Bearer ${MAM_API_TOKEN}` } : {}) },
             body: JSON.stringify({
               projectId:  completed.projectId,
               binId:      completed.binId,

services/mam-api/src/routes/recorders.js

@@ -402,6 +402,7 @@ router.post('/:id/start', async (req, res, next) => {
       `PROJECT_ID=${takeProjectId}`,
       `CLIP_NAME=${clipName}`,
       `ASSET_ID=${assetIdLive}`,
+      `MAM_API_TOKEN=${process.env.CAPTURE_TOKEN || ''}`,
       `GROWING_ENABLED=${growingEnabled ? 'true' : 'false'}`,
       `GROWING_PATH=/growing`,
     ];