Spec JSON: /api/openapi.json
Auth: header Authorization: Bearer <token> (obten via POST /api/auth/login)
Authorization: Bearer <token>
POST /api/auth/login