Add empty routes for initial api structure

[kalilsn]

Here's some notes and rough scaffolding of how I think this API will work. I'll start building out the actual functionality for these routes, auth, and api documentation now.

One early question I'm thinking about:

Should we use JWT or a more secure but less widely supported token format like paseto? Having third parties implement auth based on our JWT is exactly the scenario where JWT vulnerabilities can be an issue, e.g. jwt libraries accepting alg=none keys without verifying, or a malicious attacker setting alg to a symmetric algorithm and presenting the public key as a private one.