Auth API

User sessions, refresh, and admin user management.

POST /auth/refresh

POST /oauth/token

GET /auth/users/list

Owner routes use requireUser / requireAdmin. Access tokens are Bearer; refresh tokens are not accepted on the Computer WebSocket.