Sign in (mock)

Paste a valid JWT (must match backend JWT_SECRET). The API reads Authorization: Bearer.