REST + SSE API for the daemon.
Bound to 127.0.0.1 only; every route except the middleware passes requires Authorization: Bearer <token> (token lives in config.toml so local clients can read it).
Authorization: Bearer <token>