# viewer_token fixture is now in tests/api/conftest.py (shared across all API tests)