Stage 10 — REST API Authentication

API bearer-token authentication is installed.

• Login endpoint: /api/v1/auth/login.php
• Authenticated endpoint: /api/v1/me/
• Tokens are signed with HMAC-SHA256.
• Tokens expire after 1 hour.
• API login uses the existing secure password authentication and legacy plaintext-to-hash migration.
• Failed API logins use the existing throttle.

No database schema changes were made in this stage.