ad53ff6ffb
- requestJson now prefers HWLAB_API_KEY (env or --apiKey / --bearerToken) and sends Authorization: Bearer hwl_live_... - new client auth whoami command returns actor + authMethod via /v1/users/me - client auth status reports apiKey.source and apiKey.prefix - authVisibility + authDiagnosis surface apiKeySource/Prefix; invalid key returns api_key_invalid diagnosis - legacy cookie / auto-login paths still work when no HWLAB_API_KEY is set