Patient Management API – use /auth, /patients, etc.