feat(API): add new api for use in another project

public/.htaccess

@@ -8,5 +8,10 @@ RewriteCond %{REQUEST_METHOD} GET [OR]
 RewriteCond %{REQUEST_METHOD} POST
 RewriteRule ^view/([a-f0-9]+)/?$ view.php?id=$1 [L,QSA]
 
+# REST API routes
+RewriteRule ^api/paste/([a-f0-9]+)/unlock/?$ api.php?id=$1&action=unlock [L,QSA]
+RewriteRule ^api/paste/([a-f0-9]+)/?$ api.php?id=$1&action=get [L,QSA]
+RewriteRule ^api/paste/?$ api.php?action=create [L,QSA]
+
 # Block direct access to .env and sensitive files
 RewriteRule ^(\.env|\.git) - [F,L]

public/api.php

@@ -0,0 +1,10 @@
+<?php
+require_once __DIR__ . '/../app/controllers/ApiController.php';
+$pdo    = require __DIR__ . '/../app/core/db.php';
+$config = require __DIR__ . '/../app/config/config.php';
+
+$action = $_GET['action'] ?? '';
+$id     = $_GET['id'] ?? null;
+
+$api = new ApiController($pdo, $config);
+$api->handle($_SERVER['REQUEST_METHOD'], $action, $id);

public/router.php

@@ -12,6 +12,29 @@ if (preg_match('#^/view/([a-f0-9]+)$#i', $path, $m)) {
     exit;
 }
 
+// Route: /api/paste/{id}/unlock
+if (preg_match('#^/api/paste/([a-f0-9]+)/unlock$#i', $path, $m) && $_SERVER['REQUEST_METHOD'] === 'POST') {
+    $_GET['id']     = $m[1];
+    $_GET['action'] = 'unlock';
+    require __DIR__ . '/api.php';
+    exit;
+}
+
+// Route: /api/paste/{id}
+if (preg_match('#^/api/paste/([a-f0-9]+)$#i', $path, $m)) {
+    $_GET['id']     = $m[1];
+    $_GET['action'] = 'get';
+    require __DIR__ . '/api.php';
+    exit;
+}
+
+// Route: /api/paste
+if ($path === '/api/paste') {
+    $_GET['action'] = 'create';
+    require __DIR__ . '/api.php';
+    exit;
+}
+
 // Route: static assets
 if (preg_match('#\.(css|js|png|jpg|ico|svg|woff2?)$#', $path)) {
     return false; // let PHP built-in server serve the file