feat(api): add authenticated containers http api

GET /api/v1/containers behind bearer token auth, JSON errors for 401/404/405/500, one audit row per authenticated request, graceful shutdown; unit and e2e tests for auth, routing, auditing, request logging and server lifecycle.

routes.go

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// Copyright (C) 2026 Bryan Joshua Pedini
+
+package main
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gorilla/mux"
+)
+
+// containersPath is the only application route
+const containersPath = "/api/v1/containers"
+
+// Routes registers the application routes
+func (s *WebServer) Routes(r *mux.Router) {
+	r.HandleFunc(containersPath, s.handleContainers).MatcherFunc(noEncodedSlash).Methods(http.MethodGet)
+}
+
+// noEncodedSlash rejects paths containing a percent-encoded slash: %2F is not
+// equivalent to a path separator, so such a path is a different (unknown) route
+func noEncodedSlash(r *http.Request, _ *mux.RouteMatch) bool {
+	return !strings.Contains(strings.ToLower(r.URL.EscapedPath()), "%2f")
+}