Accounts & users

Supporting endpoints under /api/v1 for authentication state, account listing,
and device notification tokens. These come from the underlying Jumpstart platform
and use the same bearer token and response envelope
as the rest of the API.

Sessions

• POST /api/v1/auth — sign in with credentials, returns a token/session.
• DELETE /api/v1/auth — sign out / revoke the current session.
• PATCH /api/v1/password — update the current user's password.

Current user

• GET /api/v1/me — the authenticated user's profile.
• DELETE /api/v1/me — delete the current user's account.

Accounts

• GET /api/v1/accounts — the accounts (tenants) the current user belongs to.
• GET /api/v1/accounts/:id — a single account you are a member of.

Use an account's prefixed id with the X-Account-Id header (or account_id
param) to scope payslip requests to that tenant.

Users

• POST /api/v1/users — create a user (sign-up).

Notification tokens

• POST /api/v1/notification_tokens — register a device push token.
• DELETE /api/v1/notification_tokens/:token — remove a device push token.

These endpoints are provided by the platform layer. The FairCheck-specific
surface you will use most is Payslips and
Webhooks.