Read-only API. No web UI.
POST /api/search
GET /api/status
Authenticate with Authorization: Bearer <reader-token>.
Authorization: Bearer <reader-token>