refactor

- move elixForms API logic to specific folder
- move everything else under Api folder

public/index.php

@@ -1,6 +1,7 @@
 <?php
 $container = require __DIR__ . '/../bootstrap.php';
 
+use Api\Auth\ApiTokenAuthenticator;
 use Core\Router;
 use Core\Request;
 use Core\Response;
@@ -28,13 +29,28 @@ $limiter = $container->make(RateLimiterInterface::class);
 
 $router = new Router($container); // vedi nota: router può ricevere container
 
+$request = new Request();
+$response = new Response();
+
+// Autenticazione separata per le API esterne
+if (strpos($request->path(), '/api/') === 0) {
+    try {
+        $authenticator = $container->make(ApiTokenAuthenticator::class);
+        $authenticator->authenticate($request);
+    } catch (\Throwable $e) {
+        $logger->warning('External API auth failed', ['path' => $request->path(), 'error' => $e->getMessage()]);
+        $response->json(['error' => 'Unauthorized'], 401);
+    }
+}
+
 // register routes (path without version prefix)
 $router->get('/users', 'UsersController@index');
 $router->post('/users', 'UsersController@create');
 $router->get('/example', 'ExampleController@test');
 
-$request = new Request();
-$response = new Response();
+// external API routes
+$router->get('/api/elixforms/status', 'Api\\Controllers\\ExternalElixFormsController@status');
+$router->post('/api/elixforms/login', 'Api\\Controllers\\ExternalElixFormsController@login');
 
 // Rate limiting by IP address
 $key = $_SERVER['REMOTE_ADDR'] ?? 'unknown';