OK — Secure Collab API (use /api/... routes)