Nginx injects Authorization header on all /api and /events proxied requests. Token supplied via KUA_ADMIN_TOKEN env var at container runtime — never in git. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>