Add SSH-managed node registry with connection testing and reauth.

Register hosts under Containers/VMs/Docker with encrypted key storage, and require re-authentication for sensitive account changes.

service/internal/api/router.go

@@ -27,6 +27,12 @@ func NewRouter(configDir string) http.Handler {
 	mux.HandleFunc("POST /api/v1/auth/login", app.loginHandler)
 	mux.HandleFunc("POST /api/v1/auth/logout", app.logoutHandler)
 	mux.HandleFunc("GET /api/v1/auth/me", app.meHandler)
+	mux.HandleFunc("POST /api/v1/auth/reauth", app.reauthHandler)
+
+	mux.HandleFunc("PUT /api/v1/me/password", app.mePasswordHandler)
+	mux.HandleFunc("POST /api/v1/me/totp/begin", app.meTOTPBeginHandler)
+	mux.HandleFunc("POST /api/v1/me/totp/confirm", app.meTOTPConfirmHandler)
+	mux.HandleFunc("POST /api/v1/me/totp/disable", app.meTOTPDisableHandler)
 
 	mux.HandleFunc("GET /api/v1/groups", groupsGetHandler(configDir))
 	mux.HandleFunc("POST /api/v1/groups", groupsUpsertHandler(configDir))
@@ -36,7 +42,14 @@ func NewRouter(configDir string) http.Handler {
 	mux.HandleFunc("GET /api/v1/network", networkGetHandler(configDir))
 	mux.HandleFunc("PUT /api/v1/network", networkPutHandler(configDir))
 	mux.HandleFunc("GET /api/v1/users", app.usersGetHandler)
+	mux.HandleFunc("POST /api/v1/users", app.usersCreateHandler)
+	mux.HandleFunc("PATCH /api/v1/users", app.usersPatchHandler)
 	mux.HandleFunc("DELETE /api/v1/users", app.usersDeleteHandler)
 
+	mux.HandleFunc("GET /api/v1/nodes", app.nodesListHandler)
+	mux.HandleFunc("POST /api/v1/nodes", app.nodesCreateHandler)
+	mux.HandleFunc("GET /api/v1/nodes/{id}", app.nodesGetHandler)
+	mux.HandleFunc("POST /api/v1/nodes/{id}/test-ssh", app.nodesTestSSHHandler)
+
 	return app.withCORS(app.withMiddleware(mux))
 }