GET /health
liveness
POST /auth/signup
create user (username, password, pubKey, wrappedMasterKey)
POST /auth/login
exchange creds for JWT + wrappedMasterKey
POST /couple/create
start a couple, returns invite code
POST /couple/redeem
redeem partner's code
POST /couple/handoff
inviter posts sealed CMK for redeemer
GET /couple/handoff
redeemer fetches sealed CMK
GET /couple/me
current couple state
POST /photos/upload-url
presigned R2 PUT URL (needs R2 creds)
POST /photos/finalize
commit metadata after upload
GET /photos/list
your couple's photos
POST /photos/trash
self-delete
POST /photos/delete-request
request to delete partner's photo
POST /photos/delete-resolve
approve/deny a delete request
GET /notifications
your notifications
POST /notifications/read
mark notifications read