API Gateway — Control Plane

GraphQL endpoint: /graphql. Authenticate with Authorization: Bearer <token>.

Live metrics stream: /graphql/stream (SSE).