Up. Internal endpoints. Token stays out of this page.
GET /health — liveness, no authGET /status — device list (auth)POST /open — optional JSON {"door":"serial or name"} (auth)POST /close — same (auth)Auth: Authorization: Bearer … or X-Garage-Token. Query fallback: ?action=status|open|close|health.