Mercury API: keep the secret-token: prefix, and card spend is not itemized

Two gotchas hitting the Mercury banking API. (1) Auth: the API token must be sent as Authorization: Bearer secret-token:<...> with the literal secret-token: prefix INCLUDED; stripping it returns 401 noTokenInDB (the error even hints noTokenInDBButMaybeMalformed). (2) Credit-card (charge card) spend does NOT appear itemized in the account transactions endpoint it posts to checking as a single lump autopay line (e.g. IO AUTOPAY). So you cannot reconcile individual card purchases via /accounts/{id}/transactions; only the ACH/wire/checking activity shows there.