SDK auth best practices for service-to-service calls?

[PeterGames]

Good direction. Recommended baseline:
- short-lived tokens
- strict scope per service
- regular key rotation
- full audit logging for privileged actions

We are drafting an SDK auth guide and will share it soon.