feat(api): add REST endpoints for lobby create and join

- POST /api/v1/lobbies creates a lobby with a Crockford-Base32
  6-char code, retrying on unique violation up to 5 times
- POST /api/v1/lobbies/:code/join validates lobby state then
  calls the model's atomic addPlayer, idempotent for repeat
  joins from the same user
- Routes require authentication via requireAuth

apps/api/src/routes/apiRouter.ts

@@ -2,8 +2,10 @@ import express from "express";
 import { Router } from "express";
 import { healthRouter } from "./healthRouter.js";
 import { gameRouter } from "./gameRouter.js";
+import { lobbyRouter } from "./lobbyRouter.js";
 
 export const apiRouter: Router = express.Router();
 
 apiRouter.use("/health", healthRouter);
 apiRouter.use("/game", gameRouter);
+apiRouter.use("/lobbies", lobbyRouter);

apps/api/src/routes/lobbyRouter.ts

@@ -0,0 +1,14 @@
+import express from "express";
+import type { Router } from "express";
+import {
+  createLobbyHandler,
+  joinLobbyHandler,
+} from "../controllers/lobbyController.js";
+import { requireAuth } from "../middleware/authMiddleware.js";
+
+export const lobbyRouter: Router = express.Router();
+
+lobbyRouter.use(requireAuth);
+
+lobbyRouter.post("/", createLobbyHandler);
+lobbyRouter.post("/:code/join", joinLobbyHandler);