The dashboard no longer asserts its own privilege. authenticatedFetch
attached X-User-Role: admin and a hardcoded shared secret to every request
that carried no API key, both taken from the custom-auth example whose auth
function grants access for precisely those. A consumer following that
example got a dashboard that satisfied their own auth check on its own
say-so.

The API key also moves from the query string, where it was recorded in
browser history and access logs, into an X-API-Key header.

Released separately from the dashboard rebuild in v1.5.0, because none of
it depends on that work.