API Security in 2026: The Complete Developer Guide (Attacks, Fixes, and Real Code)