Root users can mint API keys for integration partners (Admin page → API Keys widget) — named, revocable, optionally pinned to one organisation; the secret is shown once at creation and partners authenticate with "Token key:secret"
New video links API — request HLS streams for a UTC timestamp and duration (a ready-to-play window playlist plus the full recording with the computed offset), or browse recent sessions with full-length stream links; API keys can call only this surface
Sessions now record their actual stop time, powering the time-window lookup
