Cooldown HTTP actions — same Bearer-token routes as the browser client and bots. Auth: POST /api/auth/register or login → Authorization: Bearer …. OpenAPI JSON: /docs/api.json