CreateUser, ListUsers (with filters), RenameUser, DeleteUser over the state layer; unknown users now 404. HTTP-parity tests via the generated client.
Mount the ogen-generated server at /api/v1 with bearer-auth and RFC 7807 errors backed by the state layer; gRPC servers stay for the CLI. Add a servertest API client harness and Health parity tests.