What I changed

• Added Swagger UI at /api/docs/
• Implemented dynamic OpenAPI JSON at /api/v1/swagger.json (scans Flask url_map for /api/v1 routes)
• Added POST /api/v1/token for credential→token exchange and configured Swagger token header auth
• Fixed token validation to use email_confirmed_at/is_active and added User.confirmed compatibility property

How to validate

• Initialize DB, start app, open /api/docs/, authorize with a token obtained from /api/v1/token and call protected endpoints.