feat(api): phase 5 — alerts, agent depth, subdomains, auth, boards

P5b: notifier transport registry (webhook/slack/discord/telegram/
gotify/ntfy/smtp via net/smtp), per-monitor+domain alert rules
(failsBeforeDown, latencyWarn, certDays, mute).

P5c: per-container cpu/mem, optional SMART/ZFS/GPU exec-or-skip
collectors, crt.sh subdomain discovery with daily sweep.

P5d: opt-in auth (bcrypt, sqlite sessions, 7d rotating cookie, login
rate limit, public-route bypass) and multiple boards (boards table,
sections.board_id, /api/boards CRUD, slug routing).

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/backend/internal/api/api.go

@@ -60,8 +60,20 @@ func (s *Server) routes() *gin.Engine {
 	r.Use(accessLog(s.log), gin.Recovery())
 
 	v1 := r.Group("/api")
+	v1.Use(s.requireAuth())
 	v1.GET("/healthz", s.healthz)
 
+	v1.GET("/auth/session", s.authSession)
+	v1.POST("/auth/setup", s.authSetup)
+	v1.POST("/auth/login", s.authLogin)
+	v1.POST("/auth/logout", s.authLogout)
+	v1.POST("/auth/disable", s.authDisable)
+
+	v1.GET("/boards", s.listBoards)
+	v1.POST("/boards", s.createBoard)
+	v1.PATCH("/boards/:id", s.updateBoard)
+	v1.DELETE("/boards/:id", s.deleteBoard)
+
 	v1.GET("/sections", s.listSections)
 	v1.POST("/sections", s.createSection)
 	v1.PATCH("/sections/:id", s.updateSection)
@@ -91,6 +103,8 @@ func (s *Server) routes() *gin.Engine {
 	v1.DELETE("/domains/:id", s.deleteDomain)
 	v1.POST("/domains/:id/refresh", s.refreshDomainH)
 	v1.GET("/domains/:id/checks", s.domainChecks)
+	v1.GET("/domains/:id/subdomains", s.listSubdomains)
+	v1.POST("/domains/:id/subdomains/refresh", s.refreshSubdomains)
 	v1.POST("/notify/test", s.notifyTest)
 
 	v1.GET("/systems", s.listSystemsH)
@@ -167,6 +181,7 @@ type Section struct {
 	Name      string  `json:"name"`
 	Position  float64 `json:"position"`
 	Collapsed bool    `json:"collapsed"`
+	BoardID   string  `json:"boardId"`
 	Items     []Item  `json:"items"`
 }