Build with clear boundaries.

The developer API is being prepared for customer-scoped credentials, usage tracking, and versioned endpoints. API keys cannot be created until the Supabase backend and server-side key hashing are configured.

• Scoped keys: Secrets are intended to be displayed once and stored only as cryptographic hashes.
• Restricted use: API access will not provide unauthorized game endpoints or override delivery controls.
• Versioned API: Planned endpoint shapes and authentication notes are in the documentation.