classifier: Support authenticated Ollama endpoints via OLLAMA_API_KEY

Ollama Cloud and other hosted endpoints reject unauthenticated requests,
so the classifier and its test harness could not reach them. Send a
Bearer token when OLLAMA_API_KEY is set, letting the same code work
against both the local instance and hosted services without changing
behavior for keyless setups.

test_classifier.py

@@ -118,10 +118,13 @@ def call_ollama(messages: list[dict]) -> dict:
         "stream": False,
         "options": {"temperature": 0},
     }).encode("utf-8")
+    headers = {"Content-Type": "application/json"}
+    if api_key := os.getenv("OLLAMA_API_KEY", ""):
+        headers["Authorization"] = f"Bearer {api_key}"
     req = Request(
         f"{OLLAMA_BASE_URL}/v1/chat/completions",
         data=payload,
-        headers={"Content-Type": "application/json"},
+        headers=headers,
         method="POST",
     )
     with urlopen(req, timeout=300) as resp: