API

Authentication Draft

Server access uses bearer JWTs carrying issuer, audience and tenant claims; session access uses the dashboard's authenticated session. Tokens are scoped, expiring and rotatable.