Wire up auth routes and encrypted URL endpoint

Add session manager and encurl generator to handlers.
Register /, /logout, /generate, /v1/e/{token}, /static/* routes.

internal/server/routes.go

@@ -7,6 +7,8 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
+
+	"sneak.berlin/go/pixa/internal/static"
 )
 
 // SetupRoutes configures all HTTP routes.
@@ -38,10 +40,22 @@ func (s *Server) SetupRoutes() {
 	// Robots.txt
 	s.router.Get("/robots.txt", s.h.HandleRobotsTxt())
 
+	// Static files (Tailwind CSS, etc.)
+	s.router.Handle("/static/*", http.StripPrefix("/static/", static.Handler()))
+
+	// Login/generator UI
+	s.router.Get("/", s.h.HandleRoot())
+	s.router.Post("/", s.h.HandleRoot())
+	s.router.Get("/logout", s.h.HandleLogout())
+	s.router.Post("/generate", s.h.HandleGenerateURL())
+
 	// Main image proxy route
 	// /v1/image/<host>/<path>/<width>x<height>.<format>
 	s.router.Get("/v1/image/*", s.h.HandleImage())
 
+	// Encrypted image URL route
+	s.router.Get("/v1/e/{token}", s.h.HandleImageEnc())
+
 	// Metrics endpoint with auth
 	if s.config.MetricsUsername != "" {
 		s.router.Group(func(r chi.Router) {