Malaleem API

API-key authentication

Gateway requests use a merchant API key (not the user JWT). Send `Authorization: Bearer <key_id>:<secret>` or the `X-Malaleem-Key` / `X-Malaleem-Secret` headers. Mint keys from the merchant API (returns the secret + webhook secret once).