feat: add JSON API with token auth (closes #69)

- Add API token model with SHA-256 hashed tokens
- Add migration 006_add_api_tokens.sql
- Add Bearer token auth middleware
- Add API endpoints under /api/v1/:
  - GET /whoami
  - POST /tokens (create new API token)
  - GET /apps (list all apps)
  - POST /apps (create app)
  - GET /apps/{id} (get app)
  - DELETE /apps/{id} (delete app)
  - POST /apps/{id}/deploy (trigger deployment)
  - GET /apps/{id}/deployments (list deployments)
- Add comprehensive tests for all API endpoints
- All tests pass, zero lint issues

internal/handlers/handlers_test.go

@@ -24,6 +24,7 @@ import (
 	"git.eeqj.de/sneak/upaas/internal/handlers"
 	"git.eeqj.de/sneak/upaas/internal/healthcheck"
 	"git.eeqj.de/sneak/upaas/internal/logger"
+	"git.eeqj.de/sneak/upaas/internal/middleware"
 	"git.eeqj.de/sneak/upaas/internal/service/app"
 	"git.eeqj.de/sneak/upaas/internal/service/auth"
 	"git.eeqj.de/sneak/upaas/internal/service/deploy"
@@ -32,10 +33,11 @@ import (
 )
 
 type testContext struct {
-	handlers *handlers.Handlers
-	database *database.Database
-	authSvc  *auth.Service
-	appSvc   *app.Service
+	handlers   *handlers.Handlers
+	database   *database.Database
+	authSvc    *auth.Service
+	appSvc     *app.Service
+	middleware *middleware.Middleware
 }
 
 func createTestConfig(t *testing.T) *config.Config {
@@ -166,11 +168,21 @@ func setupTestHandlers(t *testing.T) *testContext {
 	)
 	require.NoError(t, handlerErr)
 
+	mw, mwErr := middleware.New(fx.Lifecycle(nil), middleware.Params{
+		Logger:   logInstance,
+		Globals:  globalInstance,
+		Config:   cfg,
+		Auth:     authSvc,
+		Database: dbInstance,
+	})
+	require.NoError(t, mwErr)
+
 	return &testContext{
-		handlers: handlersInstance,
-		database: dbInstance,
-		authSvc:  authSvc,
-		appSvc:   appSvc,
+		handlers:   handlersInstance,
+		database:   dbInstance,
+		authSvc:    authSvc,
+		appSvc:     appSvc,
+		middleware: mw,
 	}
 }