Optional bearer-token authentication for the API.
Off by default, and the surface it guards is unauthenticated by design when it is off: it exposes document and memory content, session identifiers and model state, so the listener binds loopback unless a deployment asks for more. Turning this on is a separate decision from reaching the port at all.