Replace copy-pasted _get_data_dir() functions in catalog.py and upload.py with import from app.utils.get_data_dir(). sync.py and data.py already use the shared utility.
- JWT auth with role-based access control (viewer/analyst/admin/km_admin) - Endpoints: health, sync manifest, data download, query, users CRUD, corporate memory, session/artifact upload - 18 API tests covering auth, RBAC, all endpoints