Public REST API.

Programmatic access to ReceptionOS — visitor sign-ins, host directories, fire roll-call events, webhook subscriptions. Foundation stub; operations land in v1.0.

Authentication is by scope-bound API key. Outbound webhooks are signed HMAC-SHA256 over the raw request body.