- Auto-generate random 32-char bearer token on first startup, stored in
secrets.yaml as api.bearerToken
- BearerAuthMiddleware checks Authorization: Bearer <token> on all /api/
endpoints except /health, /health/reconcile, /events (SSE), and non-API
paths (frontend static files)
- Development mode (WILD_CENTRAL_ENV=development) skips auth entirely
- Web app ApiClient: add setToken/clearToken/hasToken methods, persist
token in localStorage, automatically include Authorization header on
all API requests
- Token can be found in secrets.yaml for CLI/automation use