refactor

- move elixForms API logic to specific folder
- move everything else under Api folder

src/Api/Auth/ApiTokenAuthenticator.php

@@ -0,0 +1,34 @@
+<?php
+namespace Api\Auth;
+
+use Core\Config;
+use Core\Request;
+
+class ApiTokenAuthenticator
+{
+    private Config $config;
+
+    public function __construct(Config $config)
+    {
+        $this->config = $config;
+    }
+
+    public function authenticate(Request $request): void
+    {
+        $authorization = $_SERVER['HTTP_AUTHORIZATION'] ?? $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ?? '';
+        if (!$authorization) {
+            throw new \Exception('Missing Authorization header');
+        }
+
+        if (!preg_match('/^Bearer\s+(.*)$/i', trim($authorization), $matches)) {
+            throw new \Exception('Invalid Authorization header format');
+        }
+
+        $token = $matches[1];
+        $expected = $this->config->secret('api_access_token');
+
+        if (empty($expected) || !hash_equals((string) $expected, (string) $token)) {
+            throw new \Exception('Invalid API access token');
+        }
+    }
+}