TurtleQR management API. Authenticated routes under /v1/*. Bearer ADMIN_TOKEN, session cookie, or Bearer qr_live_* / qr_test_* API key.