Accepts the canonical ID (st-...) or the set abbreviation (e.g. BS1,
SD01). Abbreviations are expected to be unique; the Worker returns 500
if more than one set shares an abbreviation (data integrity issue).
API key supplied as Authorization: Bearer <key>. Keys are minted in the
developer portal. Rejected in query strings. See the Authentication guide.
Set ID (st-...) or abbreviation (e.g. BS1, SD01).