feat(api): package skeleton + error envelope

Introduces internal/api with Mount(), the {error:{code,message}}
response shape, and stubbed login/logout/me so later tasks can
land one handler at a time without breaking the build.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/api/api.go

@@ -0,0 +1,49 @@
+// Package api implements Minstrel's native JSON surface under /api. It is
+// consumed by the built-in web SPA and (eventually) the Flutter client.
+// Subsonic-compatible endpoints under /rest are intentionally separate —
+// see internal/subsonic — and the two packages must not depend on each other.
+package api
+
+import (
+	"log/slog"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"git.fabledsword.com/bvandeusen/minstrel/internal/auth"
+)
+
+// Mount attaches /api/* handlers to r. Public endpoints (login) are outside
+// RequireUser; everything else is gated by the middleware.
+func Mount(r chi.Router, pool *pgxpool.Pool, logger *slog.Logger) {
+	h := &handlers{pool: pool, logger: logger}
+
+	r.Route("/api", func(api chi.Router) {
+		api.Post("/auth/login", h.handleLogin)
+		api.Group(func(authed chi.Router) {
+			authed.Use(auth.RequireUser(pool))
+			authed.Post("/auth/logout", h.handleLogout)
+			authed.Get("/me", h.handleGetMe)
+		})
+	})
+}
+
+type handlers struct {
+	pool   *pgxpool.Pool
+	logger *slog.Logger
+}
+
+// Stub handlers so Mount() compiles. Real implementations in later tasks
+// replace these in place (Task 6 login, Task 7 logout, Task 8 me).
+func (h *handlers) handleLogin(w http.ResponseWriter, r *http.Request) {
+	writeErr(w, http.StatusNotImplemented, "not_implemented", "login not wired")
+}
+
+func (h *handlers) handleLogout(w http.ResponseWriter, r *http.Request) {
+	writeErr(w, http.StatusNotImplemented, "not_implemented", "logout not wired")
+}
+
+func (h *handlers) handleGetMe(w http.ResponseWriter, r *http.Request) {
+	writeErr(w, http.StatusNotImplemented, "not_implemented", "me not wired")
+}