- **Bulk-import CLI (`scripts/bulk_import/oc_bulk_import.py`):** fixed the auth and GraphQL-contract bugs that made it non-functional against a running backend — `tokenAuth` no longer selects the uninstalled `refreshToken` field (which made the whole mutation error), `createCorpus` reads the flat `objId` (not the non-existent `obj{id}`), and `--corpus-id` now accepts a raw primary key (normalized to a relay global id for `documentStats`) instead of crashing with an uncaught traceback. The dead long-running-refresh path is replaced with re-authentication on a 401.
- **Bulk-import backpressure in worker-token mode.** Backpressure paces uploads off the GraphQL `documentStats.processingCount`, which a `WorkerKey` cannot authenticate — so against a **private** corpus the query returned 0 and pacing silently never engaged. `OCClient.graphql_headers()` now sends a bearer JWT when one is supplied (alongside the worker token), so `documentStats` authenticates; `run` warns when worker-token mode has no bearer token (backpressure then only works for a public corpus).
