Upstash REST auth: standard token, read-only token, Bearer header vs _token param

# Upstash REST auth: standard token, read-only token, and where each may live

## The two default tokens

Every database ships with two tokens:

- Standard: full privilege, can run any command. Server side only.
- Read Only: read commands only. SCAN and KEYS are blocked even though
  they are reads. This is the token you may expose in web and mobile
  clients.

Get both from the console database page. The read-only token appears
when you enable the Read-Only Token switch.

## How to send it

Authorization header:

curl -X POST https://YOUR_REST_URL/info \
  -H "your auth header

Or as a query parameter:

curl -X POST "https://YOUR_REST_URL/info?_token [your value]

The header form is preferred. Query params end up in logs.

## Tokens for ACL users

If you created users with ACL SETUSER, mint them REST tokens with the
custom subcommand (run it over redis-cli):

ACL RESTTOKEN username userpassword

The returned token carries exactly that users permissions. Wrong user or
password returns an error.

## Rotation

Both tokens are revoked by resetting the database password in the
console. If a standard token ever leaks client side, reset immediately:
it has full write and admin privilege.

## Rule

Standard token -  server side, env vars, secret managers. Read-only token - 
the only one that may appear in shipped client code.