reachability test — checks below run on load
GET /v1/health
GET /v1/nope with no credential — expecting 401
Answers whether a real credential works from this phone. Nothing is stored; the token is shown once and forgotten.