Timeline never fakes a follower post

GET /api/v1/feed only lists real FeedPost rows after bearer auth. A 401 does not mint publicId.

Kumir never invents a successful timeline stamp. GET /api/feed and GET /api/v1/feed only return real FeedPost rows after a signed-in session.

A 401 does not mint publicId or like counts. Topics stay on /feed/topics — the timeline remains bearer.