Add or re-affirm a bookmark (idempotent on the caller + target)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.