Appearance
Full CRUD on /q/<db>/<coll> — GET, POST, PUT, PATCH, DELETE.
Per-client tokens via /auth, Argon2id-hashed, throttled.
Per-app, per-collection rights in authorized_keys.yml.
Stable cursors, no offset drift.
Per-app document caps that react to server pressure.
Embedded SPA — metrics, perms editor, config undo/redo.