fix(webapp): match the batch item bypass auth to the route

The bypass accepted a JWT while the item stream route does not, so a JWT could
spend a grant before the route rejected it, draining budget the legitimate
secret-key stream needs.

apps/webapp/app/services/apiRateLimit.server.ts

@@ -96,7 +96,6 @@ export const apiRateLimiter = authorizationRateLimitMiddleware({
     const [authError, authenticated] = await tryCatch(
       authenticateAuthorizationHeader(authorizationValue, {
         allowPublicKey: true,
-        allowJWT: true,
       })
     );