Implement Phase 6: REST API with chi router

- Login endpoint (password → bearer token + session cookie)
- Auth middleware (bearer header or session cookie)
- Notebook list endpoint (authenticated)
- Page SVG/JPG rendering endpoints (authenticated)
- Notebook PDF download endpoint (authenticated)
- Share link endpoints: view, page SVG, page JPG, PDF (no auth)
- Route registration with chi groups

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/routes.go

@@ -0,0 +1,28 @@
+package server
+
+import (
+	"database/sql"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func RegisterRoutes(r *chi.Mux, database *sql.DB, baseURL string) {
+	// Public
+	r.Post("/v1/auth/login", handleLogin(database))
+
+	// Share links (no auth)
+	r.Get("/s/{token}", handleShareView(database))
+	r.Get("/s/{token}/pages/{num}/svg", handleSharePageSVG(database))
+	r.Get("/s/{token}/pages/{num}/jpg", handleSharePageJPG(database))
+	r.Get("/s/{token}/pdf", handleSharePDF(database))
+
+	// Authenticated
+	r.Group(func(r chi.Router) {
+		r.Use(AuthMiddleware(database))
+
+		r.Get("/v1/notebooks", handleListNotebooks(database))
+		r.Get("/v1/notebooks/{id}/pages/{num}/svg", handlePageSVG(database))
+		r.Get("/v1/notebooks/{id}/pages/{num}/jpg", handlePageJPG(database))
+		r.Get("/v1/notebooks/{id}/pdf", handleNotebookPDF(database))
+	})
+}