API access control: guards, default roles, tokens, related records

Every /api route runs on the api guard with one optional-token authentication and one switch, permissions are checked on the request's guard on every path, guest exposes only the public CMS list, related records obey their own permission and ACL in select and search, writes never touch what the writer cannot see, and users and service accounts can hold scoped tokens.