refactor(routes): extract user and application routes into auth domain

Move /api/cms/user and /api/skydive/applications to a new /api/auth domain.
Users and API key applications are identity/access concerns, not CMS or
skydive content. The auth domain provides a clear boundary for future
middleware hardening (rate limiting, audit logging, etc).

docs: add ADR 0014

src/routes/api/skydive/index.js

@@ -1,6 +1,5 @@
 var routes = require('express').Router();
 
-routes.use('/applications', require('./applications.routes'));
 routes.use('/aeronefs', require('./aeronefs.routes'));
 routes.use('/canopies', require('./canopies.routes'));
 routes.use('/dropzones', require('./dropzones.routes'));