Tracebud Partner API (1.0.0)

Curated partner-facing subset of the Tracebud Nest API (/api global prefix).

Auth: Authorization: Bearer <token> where <token> is either a Supabase user JWT or a tenant API key secret (tbk_live_…). API key management (/v1/api-keys) requires a signed-in dashboard user JWT — keys cannot mint or revoke other keys.

Not in this document: dashboard Next.js BFF (app/api/**), marketing leads APIs, PostgREST on product tables, GraphQL, or unauthenticated access.

The full internal surface remains docs/openapi/tracebud-v1-draft.yaml.