fetch private biomodels when the user is logged in

[androemeda]

Summary

Currently the backend fetches biomodels from VCell's legacy v0 API (vcell.cam.uchc.edu/api/v0) without any credentials, so only public models are ever visible — regardless of whether the user is logged in. This PR adds an opt-in auth path: when a request carries a valid Auth0 bearer token, the backend exchanges it for a legacy VCell token (POST /api/v1/users/bearerToken) and forwards that to the v0 API, so logged-in users also see their private and shared biomodels. Logged-out requests are unaffected — v0 calls without a token behave exactly as before.

Backend

• core/auth.py: new get_optional_auth0_token dependency — returns None when no Authorization header is sent (public-only).
• vcelldb_service.py: new get_legacy_vcell_token() does the Auth0 → legacy token exchange. fetch_biomodels() and get_diagram_image() now take an optional auth0_token and attach the exchanged legacy token as Authorization: Bearer on the v0 call when present.
• GET /biomodel and GET /biomodel/{id}/diagram/image now depend on get_optional_auth0_token.
• /query (chat): the route now also resolves the raw access token and threads it through llms_controller → llms_service.get_response_with_tools → tools_utils.execute_tool, so the fetch_biomodels tool call the chatbot makes also includes private/shared models when logged in.
• analyse_diagram() (the diagram-analysis LLM call, used by the "AI Analysis" tab): now fetches the diagram image itself via get_diagram_image(biomodel_id, auth0_token) and passes it to the LLM inline as a base64 data:image/png;base64,... URL, instead of a raw VCell URL. The LLM provider fetches image_url values from its own infrastructure, with no way to forward our Authorization header, so a plain VCell URL could never resolve for a private/shared biomodel — this was throwing a hard 400 from the LLM provider rather than silently degrading. Also threads the token into the fetch_biomodels call in the same function so the accompanying text context resolves correctly too.

Frontend

• New lib/get-optional-access-token.ts — like getAccessToken, but resolves to undefined instead of throwing when there's no session.
• search/page.tsx, search/[bmid]/page.tsx, analyze/[id]/page.tsx now send the token (when available) on their /biomodel* fetches.