## DMS JWT Enforcement
- `DocumentsController::simpleUpload` and existing routes expect JWT Bearer auth. Ensure clients pass `Authorization: Bearer <token>` to avoid 401s.
- Public forms no longer fallback to session-only auth. Update embedded forms to attach JWTs when calling `/api/documents` endpoints.