Authentication & API keys

Provide X-RC-API-Key or Authorization: Bearer rk_…. Keys are salted + hashed server-side — plaintext is shown exactly once during provisioning. Rotate keys periodically; disabled keys deny immediately across the fleet.

Scopes (e.g. cad:write) constrain each route in the published RC Lite OpenAPI document.