API Keys

Bearer keys authenticate calls to /v1/run/:flow. We store only a hash — the full key is shown once.