session-viz backend v0

PLANE A — fleet telemetry (person-blind, closed schema, k-gated)
  GET  /healthz
  GET  /v1/reference/latest    public, Ed25519-signed
  GET  /v1/pubkey
  POST /v1/contrib             Bearer CONTRIB_TOKEN
  GET  /admin?token=...

PLANE B — collaboration (identity-bearing; cannot join plane A)
  GET  /v1/live                SSE stream        Bearer COLLAB_TOKEN
  POST /v1/mcp                 stateless MCP     Bearer + X-Actor
  GET  /v1/vaults              ?scope=
  POST /v1/vaults              register/refresh a vault index
  GET  /v1/vaults/resolve      ?name=[[Link]]&from=vault_id
  GET  /v1/vaults/dangling     ?vault=vault_id
  GET  /v1/tasks               ?mine=1&state=&scope=
  POST /v1/tasks               create
  POST /v1/tasks/:id/offered|accepted|done
  GET  /v1/events              ?since=seq

AUTH — passwordless, multi-tenant (mandantenfähig)
  POST /v1/auth/otp/start           {email}
  POST /v1/auth/otp/verify          {email, code} -> session token
  POST /v1/auth/passkey/challenge   {email, kind:register|login}
  POST /v1/auth/passkey/register    {challengeId, email, credential}
  POST /v1/auth/passkey/login       {challengeId, credential}
  GET  /v1/auth/me                  Bearer session
  POST /v1/auth/logout

TEAM — L1 tenant administration (admin role required)
  GET  /v1/team                     members of your tenant
  POST /v1/team/invite              {email, role}
  POST /v1/team/role                {accountId, role}
  POST /v1/team/status              {accountId, status}

OPS — L0 operator, metadata only, every action audited
  GET  /ops                         console (operator session)
  GET  /v1/ops/overview
  GET  /v1/ops/audit
  POST /v1/ops/tenant/status        {tenant, status, note}
  POST /v1/ops/tenant/delete        {tenant, confirm, alsoFindings}
  GET  /v1/ops/mail                 delivery health + last 100 sends
  POST /v1/ops/mail/test            send yourself a test