Player login via Discord ID or Apple ID · backend routes under /auth
/auth
Tokens are stored in localStorage (the admin-portal convention) and sent as Authorization: Bearer <jwt>.
Authorization: Bearer <jwt>