Public when ?address= is provided (Authorization ignored); bearer-token mode without address returns the caller's own data.