Core API v1 reference: working paths and header authentication

Requests built from the v1 reference now reach the right endpoint. Several paths showed :app_key or a literal app_key, so Try It and copied cURL commands failed. All paths now use your app key.

Send your utoken in the X-Yotpo-Token header. Every v1 endpoint accepts it, and it keeps the token out of URLs. Passing utoken in the request body still works.

Corrected endpoints:

• Create mass orders: orders is an array, and coupon_used is a boolean.
• Create order: products is required.
• Invalidate order: new examples.
• Create and update mass products: return_email_address and result_callback_url are optional.
• Yotpo authentication: invalid_client and unsupported_grant_type return 400.