Auth

Anonymous for light use (Soft D2.2: send sealed `X-Duan-Client-Id` or keep `duan_anon`); session for the web app; API keys for agents. Never paste secrets into chat.

• Anonymous — light create within rate limits. Soft D2.2: store/resend sealed `X-Duan-Client-Id` (agents) or HttpOnly `duan_anon` (browsers). Not an account.
• Session cookie (`duan_session`) — web dashboard
• Authorization: Bearer — scoped API key (dashboard mint or Soft D2.1 interim smoke-key). Idempotency scopes to api_key_id / user.

Never paste API secrets into chat.

Machine discovery: `GET /v1/capabilities` (OpenAPI 1.5.0).