All 7 endpoints. Same headers, same JSON shapes, same error codes as the real STC sandbox — just pointing at our built-in mock so the demo works without STC credentials.