HumanityAid device control-plane - direct origin (server: nginx).
Device agents POST /api/v1/devices/checkin over mTLS. Health: /healthz
Operator dashboard is on haid-mgmt.humanityaid.work (behind Cloudflare Access).