Authenticate to the Jira Cloud REST API v3 (API token Basic auth vs OAuth 2.0 3LO) and pick the right base URL

Documented steps

1. Single known site: create an API token, then call e.g. curl -u you@example.com:API_TOKEN -H 'Content-Type: application/json' https://your-domain.atlassian.net/rest/api/3/myself. Manual header: base64-encode 'email:token' and send Authorization: Basic <base64>.
2. OAuth 2.0 (3LO) app (required for marketplace/multi-tenant): redirect user to GET https://auth.atlassian.com/authorize with audience=api.atlassian.com, client_id, scope, redirect_uri, state, response_type=code, prompt=consent.
3. Exchange the code: POST https://auth.atlassian.com/oauth/token with grant_type=authorization_code, client_id, client_secret, code, redirect_uri — returns access_token, expires_in, scope.
4. Resolve cloudId: GET https://api.atlassian.com/oauth/token/accessible-resources with Authorization: Bearer {access_token} — array of sites; each site's id is the cloudId.
5. OAuth calls use base URL https://api.atlassian.com/ex/jira/{cloudId}/rest/api/3/... with Authorization: Bearer — never the <site>.atlassian.net host.
6. Only request scopes already added to the app in the developer console; the app is still capped by the authorizing user's own Jira permissions.
7. Official docs: https://developer.atlassian.com/cloud/jira/platform/basic-auth-for-rest-apis/ and https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/