Challenge 1: Pick the Browser Technique — Possible Solution
====================================================================

(a) Checking a public GET endpoint returns data — URL ADDRESS BAR.
This is the simplest possible read-only check with no headers or body
needed — pasting the URL directly is strictly less setup than opening
DevTools or writing a fetch() call for the exact same result.

(b) Sending a POST with a JSON body and a bearer token — fetch() IN
THE CONSOLE. Neither the address bar nor a plain HTML form can send a
JSON body or a custom Authorization header at all — this need
specifically requires fetch()'s full options object (method, headers,
body), the one browser technique in this chapter capable of it.

(c) Reproducing the exact request a page just made as a cURL command —
DEVTOOLS NETWORK TAB (Copy as cURL). This isn't about building a new
request at all — it's about capturing one that ALREADY happened, which
is specifically what the Network tab's request inspection and "Copy as
cURL" feature are for; fetch() would require manually reconstructing
the request's exact headers/body from scratch instead of exporting
them directly.