Baler Auth API

Identity: login, API-key issuance/revocation, org/site directory CRUD. Separate process/port from ingest/fault/derivation/validate - this document is served by the process it actually describes.

Role/site/rate-limit enforcement for every route below (except POST /auth/login, which can't require a token to get a token) happens in the gateway itself (nginx + njs), not in this service - see gateway/njs/policy.js for the actual per-route role requirements. This spec documents the request/response shapes, not the authorization policy.