Clarify Session vs Bearer-Token API Auth in Docs

The docs do not make it obvious which endpoints are session-only versus which accept a bearer token, so developers hit confusing auth errors. Clear guidance on which auth method each endpoint expects would prevent wasted debugging.