English-only by policy. A ?lang= that isn’t en returns 400 so the
boundary is visible to clients instead of silently defaulting.
Session token issued by POST /api/users/login, transported as Authorization: Bearer <token>.
Language code. Only en is supported; any other value returns 400.