- users table: email, password_hash (bcrypt), role, is_active - POST /auth/register — checks blocklist, hashes password, returns JWT - POST /auth/login — verifies password, returns JWT - Auth middleware: accepts env tokens (dev) OR valid JWTs - end-user role → 403 Insufficient permissions on all /api/* routes - JWT_SECRET + JWT_EXPIRES_IN env vars Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
All /api/* routes require Authorization: Bearer <token>. Tokens are configured via API_TOKENS env var (comma-separated for multiple). /health remains public for Coolify health checks. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
