scaffold: Backend API routes, DB queries, and middleware stubs

88 handler stubs across 13 route files, 66 DB query stubs across
11 modules, auth/license extractors, and rate limit middleware.
All bodies are todo!() — ready for Phase 1b implementation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/src/api/auth.rs

@@ -0,0 +1,48 @@
+use std::sync::Arc;
+
+use axum::{
+    routing::post,
+    Router,
+};
+
+use crate::models::error::ApiResult;
+use crate::AppState;
+
+pub fn router() -> Router<Arc<AppState>> {
+    Router::new()
+        .route("/login", post(login))
+        .route("/register", post(register))
+        .route("/verify-totp", post(verify_totp))
+        .route("/refresh", post(refresh))
+        .route("/setup-totp", post(setup_totp))
+        .route("/backup-codes", post(backup_codes))
+        .route("/logout", post(logout))
+}
+
+async fn login() -> ApiResult<impl axum::response::IntoResponse> {
+    todo!()
+}
+
+async fn register() -> ApiResult<impl axum::response::IntoResponse> {
+    todo!()
+}
+
+async fn verify_totp() -> ApiResult<impl axum::response::IntoResponse> {
+    todo!()
+}
+
+async fn refresh() -> ApiResult<impl axum::response::IntoResponse> {
+    todo!()
+}
+
+async fn setup_totp() -> ApiResult<impl axum::response::IntoResponse> {
+    todo!()
+}
+
+async fn backup_codes() -> ApiResult<impl axum::response::IntoResponse> {
+    todo!()
+}
+
+async fn logout() -> ApiResult<impl axum::response::IntoResponse> {
+    todo!()
+}