Expand description
REST + SSE API for the daemon.
Bound to 127.0.0.1 only; routes require Authorization: Bearer <token>
(token lives in config.toml so local clients can read it), except the
stream route, which also accepts the short-lived capability token that
/play embeds in the URL — real players can’t send headers, so the URL
itself is the ticket.