Routes move to server/routes/ (auth, account, projects, reader, sharing, admin);
index.js keeps setup only. A smoke test walks 90 API calls against the real
server and compares every status with the pre-split behaviour.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
