**Epic:** #25 — Foundations & DX — make it OSS-ready Optional bearer-token gate in front of `--public` (Funnel) endpoints. **Acceptance:** a `--public --auth` endpoint rejects requests without the token.
Epic: #25 — Foundations & DX — make it OSS-ready
Optional bearer-token gate in front of
--public(Funnel) endpoints.Acceptance: a
--public --authendpoint rejects requests without the token.