docs/security.md

# Security: Bearer Token Auth

All endpoints require authentication via Bearer token:

- Set `SECRET_TOKEN` in `.env`
- Add header: `Authorization: Bearer <SECRET_TOKEN>`

Unauthorized requests receive `403 Forbidden`.