Stage 2: users, API key auth, bootstrap endpoint

- Migration 002: users and api_keys tables (Unix timestamps, FK cascade)
- POST /api/bootstrap — creates first user + key when DB is empty
- POST/GET/DELETE /api/users — user CRUD
- POST/DELETE /api/users/{id}/api-keys — key issuance and revocation
- AuthMiddleware: SHA-256 bearer token lookup, last_used_at tracking
- Raw key returned once on creation; only SHA-256 hash stored

internal/api/router.go

@@ -2,7 +2,6 @@ package api
 
 import (
 	"database/sql"
-	"encoding/json"
 	"net/http"
 
 	"github.com/go-chi/chi/v5"
@@ -15,8 +14,21 @@ func NewRouter(db *sql.DB) http.Handler {
 	r.Use(middleware.Recoverer)
 
 	r.Get("/healthz", func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		json.NewEncoder(w).Encode(map[string]string{"status": "ok"})
+		respond(w, http.StatusOK, map[string]string{"status": "ok"})
+	})
+
+	// Unauthenticated: bootstrap (only works when user table is empty).
+	r.Post("/api/bootstrap", handleBootstrap(db))
+
+	// All other /api routes require a valid API key.
+	r.Group(func(r chi.Router) {
+		r.Use(AuthMiddleware(db))
+
+		r.Get("/api/users", handleListUsers(db))
+		r.Post("/api/users", handleCreateUser(db))
+		r.Delete("/api/users/{id}", handleDeleteUser(db))
+		r.Post("/api/users/{id}/api-keys", handleCreateAPIKey(db))
+		r.Delete("/api/users/{id}/api-keys/{keyID}", handleDeleteAPIKey(db))
 	})
 
 	return r