Public REST API + webhooks: /api/v1 + signed outbound events

API keys (dfk_…) with 11 named scopes, /api/v1/assets shipped with cursor pagination, signed webhooks with HMAC-SHA256 + exponential-backoff retry, dispatcher cron. Full reference at /docs/api.