Internal API

Service-to-service endpoints, called by other backend services (projectx, the approvals engine), not by any frontend. They are HMAC-signed or role-gated and carry their own real /internal/* paths — no proxy, no route rewriting. They are federated here and grouped by function; the owning service is marked per endpoint (tag/description) rather than split into per-service sections.