refactor: extract smirk auth routes from index.js

The three /api/auth/smirk/* endpoints move to src/routes/auth.js as a DI
factory createAuthRoutes(ctx), mounted conditionally on SMIRK_ENABLED.
Handler bodies unchanged.

index.js: 1047 -> 882 lines (was 2029 before the split began). Adds an auth
smoke test. Full suite: 21 suites / 155 tests.

test/adminRoutes.test.js

@@ -7,6 +7,7 @@
  */
 
 const createAdminRoutes = require('../src/routes/admin');
+const createAuthRoutes = require('../src/routes/auth');
 
 function stubCtx() {
   return {
@@ -48,3 +49,16 @@ describe('admin routes factory', () => {
     expect(paths.length).toBe(expected.length);
   });
 });
+
+describe('auth (smirk) routes factory', () => {
+  test('builds a router and registers the smirk endpoints', () => {
+    const router = createAuthRoutes({ db: { query: jest.fn() } });
+    const paths = router.stack.filter(l => l.route).map(l => l.route.path);
+    expect(paths).toEqual(expect.arrayContaining([
+      '/api/auth/smirk/challenge',
+      '/api/auth/smirk/verify',
+      '/api/auth/smirk/status'
+    ]));
+    expect(paths.length).toBe(3);
+  });
+});