* feat: ratelimit, ghcr package and proper project refactor from askarzh
* fix(bridge): validate media path
* update: dependencies
* fix: added LID to contact number migration
The HTTP API uses a JWT-based scheme, not an "ApiKey <key>" scheme.
`auth/login.go` accepts `Authorization: Bearer <api-key>` on
`/auth/login`, returns a JWT, and the JwtAuthMiddleware then expects
`Authorization: Bearer <jwt>` on every `/api/*` request. The previous
example would 401.
Replace the section with the actual two-step flow plus a working
`curl` invocation for each step. Also fix the endpoint path
(`/api/messages`, not `/messages`).
Atul Singh