Lucida auth API — served by Cloud Functions via Firebase Hosting rewrites.