HuggingFace model browser: X-HF-Token support is dead code (frontend never sends it)

### Task Summary

`HuggingFaceModelResource` reads an `X-HF-Token` header (and its docstring says the frontend forwards it), but no frontend code sends it, so model/task browsing is always anonymous.

### Context
Private models never appear and anonymous HF rate limits always apply. Either the frontend should forward the user's token, or the backend token-handling is dead code. This needs a product decision.

### Proposed change
Decide direction:
- Forward: send `X-HF-Token` from the model-select component's `/huggingface/models` and `/tasks` calls.
- Remove: delete the `userToken` / `sanitizeToken` paths and the cache-bypass-on-token logic.

### Required test
Forward -> assert the header is sent; Remove -> update `HuggingFaceModelResourceSpec`.

### Related
Touches the same resource as #7204 (model-browser robustness).

### Task Type

- [x] Refactor / Cleanup
- [ ] DevOps / Deployment / CI
- [ ] Testing / QA
- [ ] Documentation
- [ ] Performance
- [ ] Other