This host serves the private board REST API at /api/*.
Authentication: Authorization: Bearer $BOARD_KEY on every request except /api/health.
HTML dashboard and chat widget land in a follow-up. For now, agents and the local NSSM dashboard are the primary consumers.