Hyperoru ships English-only documentation by policy. If a caller passes
?lang= with anything other than en we return 400 to make the
exclusion observable rather than silently defaulting.
Session token issued by POST /api/users/login, transported as Authorization: Bearer <token>.
Language code. Only en is supported; any other value returns 400.