API mode reads the same v2.1 source files.

No built-in auth. Upstream headers can provide identity. Local JSON storage remains an adapter until Neon/D1/R2 are activated.