Add an anonymous read-only state endpoint for the public website, backed by the private competition service. Keep draft reads and writes behind existing admin login and document the production routing.
Keep the authenticated management endpoint and forward requests over the private network without a service token. Document the private upstream URL, source IP allowlist, and public route isolation.
Forward authenticated GET and PUT requests to the website competition service using a server-side token. Register a dedicated HttpClient and document configuration, deployment, API behavior, and validation.
