Authentication

• Public endpoints (health, openapi, onboarding) — no auth needed.
• API key — click Authorize and paste a Bearer token (jc_test_... / jc_live_...) or fill the X-Api-Key header.
• Console session— log in at /login first, then return here; your session cookie will be sent automatically.