refactor routing into a modular and versioned structure

Move inline route definitions from main.go into a dedicated internal/routes package. This organization introduces support for API versioning (v1) and separates endpoint logic into specialized modules for administration and bug reporting.

internal/routes/v1/admin.go

@@ -0,0 +1,37 @@
+package v1
+
+import (
+	apimw "emly-api-go/internal/middleware"
+	"time"
+
+	"emly-api-go/internal/handlers"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/httprate"
+	"github.com/jmoiron/sqlx"
+)
+
+func registerAdmin(r chi.Router, db *sqlx.DB) {
+	r.Route("/admin", func(r chi.Router) {
+		r.Use(httprate.LimitByIP(30, time.Minute))
+
+		// Auth — public, handles its own credential checks
+		r.Route("/auth", func(r chi.Router) {
+			r.Post("/login", handlers.LoginUser(db))
+			r.Get("/validate", handlers.ValidateSession(db))
+			r.Post("/logout", handlers.LogoutSession(db))
+		})
+
+		// User management — protected via Admin Key
+		r.Route("/users", func(r chi.Router) {
+			r.Use(apimw.AdminKeyAuth(db))
+
+			r.Get("/", handlers.ListUsers(db))
+			r.Post("/", handlers.CreateUser(db))
+			r.Get("/{id}", handlers.GetUserByID(db))
+			r.Patch("/{id}", handlers.UpdateUser(db))
+			r.Post("/{id}/reset-password", handlers.ResetPassword(db))
+			r.Delete("/{id}", handlers.DeleteUser(db))
+		})
+	})
+}