refactor(routes): extract user and application routes into auth domain

Move /api/cms/user and /api/skydive/applications to a new /api/auth domain.
Users and API key applications are identity/access concerns, not CMS or
skydive content. The auth domain provides a clear boundary for future
middleware hardening (rate limiting, audit logging, etc).

docs: add ADR 0014

src/routes/api/index.js

@@ -1,5 +1,6 @@
 var routes = require('express').Router();
 
+routes.use('/auth', require('./auth'));
 routes.use('/skydive', require('./skydive'));
 routes.use('/cms', require('./cms'));
 routes.use('/ecommerce', require('./ecommerce'));