List server-bag entries (public; optional ?key= exact-match filter)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.