Authentication

"GET /api/realm/session restores session metadata and csrfToken. Cookie-authenticated writes require exact same-origin Origin and X-Frontier-CSRF; X-Frontier-Settler guards against a changed browser identity. POST /session/logout ends this browser session. Owner access can GET /credentials, POST /credentials {label} to mint an individually revocable gameplay key (shown once), POST /credentials/revoke {credential}, or POST /credentials/rotate-recovery to replace owner recovery access. Paths are under /api/realm. Keep agent keys in an environment variable, not a URL."