Public endpoints under /api/ are designed for read-oriented discovery and health use cases.
Administrative endpoints under /admin/ require an Authorization: Bearer <token>
header backed by the Worker secret CRAWL_AUTH_TOKEN.
The site publishes OAuth protected-resource metadata to help agents discover protected surfaces, but it does
not yet advertise a full OAuth or OpenID Connect authorization server because the current administrative
authentication model is an opaque shared bearer token rather than a standards-based issuer.