JWT for platform routes; API keys for /api/v1.
Send credentials on every request.
/api/auth/telegram-login/
/api/auth/send-otp/
/api/auth/verify-otp/
Authorization: Bearer pk_live_… or ?api_key= on v1 only.
Authorization: Bearer pk_live_…
?api_key=