API keys

Keys look like pln_live_…. Send as x-plinth-key or Authorization: Bearer.

Anonymous requests are rate-limited by IP. Paid entitlements attach to the user who owns the key via Polar webhooks.

Claim a key after checkout at /start.