Send a friend request (idempotent on the unordered pair; mutual → auto-accept)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.