Authentication

All endpoints require: - Authorization: Bearer <token> - UAPK-Manifest: <content-addressed pointer or signed reference> - Optional: Idempotency-Key: <uuid-v4>

Tokens are environment-scoped. Rotate regularly; never embed in code.