feat: add JSON API with token auth (closes #69)

- Add API token model with SHA-256 hashed tokens
- Add migration 006_add_api_tokens.sql
- Add Bearer token auth middleware
- Add API endpoints under /api/v1/:
  - GET /whoami
  - POST /tokens (create new API token)
  - GET /apps (list all apps)
  - POST /apps (create app)
  - GET /apps/{id} (get app)
  - DELETE /apps/{id} (delete app)
  - POST /apps/{id}/deploy (trigger deployment)
  - GET /apps/{id}/deployments (list deployments)
- Add comprehensive tests for all API endpoints
- All tests pass, zero lint issues

internal/server/routes.go

@@ -98,6 +98,21 @@ func (s *Server) SetupRoutes() {
 		})
 	})
 
+	// API v1 routes (Bearer token auth, no CSRF)
+	s.router.Route("/api/v1", func(r chi.Router) {
+		r.Use(s.mw.APITokenAuth())
+
+		r.Get("/whoami", s.handlers.HandleAPIWhoAmI())
+		r.Post("/tokens", s.handlers.HandleAPICreateToken())
+
+		r.Get("/apps", s.handlers.HandleAPIListApps())
+		r.Post("/apps", s.handlers.HandleAPICreateApp())
+		r.Get("/apps/{id}", s.handlers.HandleAPIGetApp())
+		r.Delete("/apps/{id}", s.handlers.HandleAPIDeleteApp())
+		r.Post("/apps/{id}/deploy", s.handlers.HandleAPITriggerDeploy())
+		r.Get("/apps/{id}/deployments", s.handlers.HandleAPIListDeployments())
+	})
+
 	// Metrics endpoint (optional, with basic auth)
 	if s.params.Config.MetricsUsername != "" {
 		s.router.Group(func(r chi.Router) {