Claude's usage/prepaid/overage endpoints require Origin, Referer, and User-Agent headers to pass CORS/auth checks. Without them, bootstrap succeeds (more permissive) but usage returns 403 -> 'Not signed in'. Added claudeAPIRequest(for:) helper that sets all required browser-like headers on every request. Bootstrap, usage, prepaid, overage, and the orgs fallback all go through it.