Wire up auth routes and encrypted URL endpoint

Add session manager and encurl generator to handlers.
Register /, /logout, /generate, /v1/e/{token}, /static/* routes.

internal/handlers/handlers.go

@@ -11,9 +11,11 @@ import (
 	"go.uber.org/fx"
 	"sneak.berlin/go/pixa/internal/config"
 	"sneak.berlin/go/pixa/internal/database"
+	"sneak.berlin/go/pixa/internal/encurl"
 	"sneak.berlin/go/pixa/internal/healthcheck"
 	"sneak.berlin/go/pixa/internal/imgcache"
 	"sneak.berlin/go/pixa/internal/logger"
+	"sneak.berlin/go/pixa/internal/session"
 )
 
 // Params defines dependencies for Handlers.
@@ -33,6 +35,8 @@ type Handlers struct {
 	config   *config.Config
 	imgSvc   *imgcache.Service
 	imgCache *imgcache.Cache
+	sessMgr  *session.Manager
+	encGen   *encurl.Generator
 }
 
 // New creates a new Handlers instance.
@@ -91,6 +95,23 @@ func (s *Handlers) initImageService() error {
 	s.imgSvc = svc
 	s.log.Info("image service initialized")
 
+	// Initialize session manager and URL generator if signing key is configured
+	if s.config.SigningKey != "" {
+		sessMgr, err := session.NewManager(s.config.SigningKey, !s.config.Debug)
+		if err != nil {
+			return err
+		}
+		s.sessMgr = sessMgr
+
+		encGen, err := encurl.NewGenerator(s.config.SigningKey)
+		if err != nil {
+			return err
+		}
+		s.encGen = encGen
+
+		s.log.Info("session manager and URL generator initialized")
+	}
+
 	return nil
 }
 

internal/server/routes.go

@@ -7,6 +7,8 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
+
+	"sneak.berlin/go/pixa/internal/static"
 )
 
 // SetupRoutes configures all HTTP routes.
@@ -38,10 +40,22 @@ func (s *Server) SetupRoutes() {
 	// Robots.txt
 	s.router.Get("/robots.txt", s.h.HandleRobotsTxt())
 
+	// Static files (Tailwind CSS, etc.)
+	s.router.Handle("/static/*", http.StripPrefix("/static/", static.Handler()))
+
+	// Login/generator UI
+	s.router.Get("/", s.h.HandleRoot())
+	s.router.Post("/", s.h.HandleRoot())
+	s.router.Get("/logout", s.h.HandleLogout())
+	s.router.Post("/generate", s.h.HandleGenerateURL())
+
 	// Main image proxy route
 	// /v1/image/<host>/<path>/<width>x<height>.<format>
 	s.router.Get("/v1/image/*", s.h.HandleImage())
 
+	// Encrypted image URL route
+	s.router.Get("/v1/e/{token}", s.h.HandleImageEnc())
+
 	// Metrics endpoint with auth
 	if s.config.MetricsUsername != "" {
 		s.router.Group(func(r chi.Router) {