Operator REST routes under /auth for credential management.

What problem this solves

WebRTC signaling backends and operators need to create long-term TURN credentials and mint coturn-compatible REST shared-secret username/password pairs without custom tooling. POST /auth adds or generates users in Auth.Client; GET /auth/rest returns TTL credentials when shared-secret auth is enabled (503 when disabled).

Responses include suggested turn: / turns: URIs derived from server config.

RFCs

• RFC 8489 (long-term credentials, MESSAGE-INTEGRITY)
• RFC 5766 (TURN URIs returned by REST minting)
• TURN REST shared-secret credentials (coturn-compatible TTL usernames)