refactor(routes): extract user and application routes into auth domain

Move /api/cms/user and /api/skydive/applications to a new /api/auth domain.
Users and API key applications are identity/access concerns, not CMS or
skydive content. The auth domain provides a clear boundary for future
middleware hardening (rate limiting, audit logging, etc).

docs: add ADR 0014

src/routes/api/auth/index.js

@@ -0,0 +1,6 @@
+var routes = require('express').Router();
+
+routes.use('/user', require('./users.routes'));
+routes.use('/applications', require('./applications.routes'));
+
+module.exports = routes;

src/routes/api/cms/index.js

@@ -1,6 +1,5 @@
 var routes = require('express').Router();
 
-routes.use('/user', require('./users.routes'));
 routes.use('/articles', require('./articles.routes'));
 routes.use('/comments', require('./comments.routes'));
 routes.use('/profiles', require('./profiles.routes'));

src/routes/api/index.js

@@ -1,5 +1,6 @@
 var routes = require('express').Router();
 
+routes.use('/auth', require('./auth'));
 routes.use('/skydive', require('./skydive'));
 routes.use('/cms', require('./cms'));
 routes.use('/ecommerce', require('./ecommerce'));

src/routes/api/skydive/index.js

@@ -1,6 +1,5 @@
 var routes = require('express').Router();
 
-routes.use('/applications', require('./applications.routes'));
 routes.use('/aeronefs', require('./aeronefs.routes'));
 routes.use('/canopies', require('./canopies.routes'));
 routes.use('/dropzones', require('./dropzones.routes'));