refactor: add library and device route stubs to router package

Add stub implementations for:
- library.go: Library management routes (admin + user visibility)
- device.go: Device registration and management routes
- router.go: Updated to import jwt package

Router package structure is complete with all route groups defined.
Next step: Incrementally migrate routes from main.go by calling
router.RegisterRoutes() and removing duplicate definitions.

All verification checks pass (26/26).

internal/router/device.go

@@ -0,0 +1,42 @@
+package router
+
+import (
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/labstack/echo-jwt/v4"
+	"github.com/labstack/echo/v4"
+)
+
+func registerDeviceRoutes(cfg *Config) {
+	e := cfg.Echo
+
+	// JWT middleware
+	jwtMiddleware := echojwt.WithConfig(echojwt.Config{
+		SigningKey: []byte(cfg.Cfg.JWTSecret),
+		ContextKey: "user",
+		SuccessHandler: func(c echo.Context) {
+			token := c.Get("user").(*jwt.Token)
+			claims := token.Claims.(jwt.MapClaims)
+			c.Set("user_id", claims["user_id"])
+			c.Set("user_role", claims["user_role"])
+			c.Set("user_email", claims["user_email"])
+			c.Set("user_username", claims["user_username"])
+		},
+	})
+
+	// Protected routes
+	protected := e.Group("/api", jwtMiddleware)
+
+	// Public device registration routes (no auth required)
+	e.POST("/api/devices/register", cfg.DeviceHandler.InitiateRegistration)
+	e.POST("/api/devices/register/status", cfg.DeviceHandler.CheckRegistrationStatus)
+	e.GET("/api/devices/approve/:token", cfg.DeviceHandler.ApproveDevice)
+	e.POST("/api/devices/reject/:token", cfg.DeviceHandler.RejectDevice)
+
+	// Device management routes (protected)
+	devices := protected.Group("/devices")
+	devices.GET("", cfg.DeviceHandler.ListDevices)
+	devices.GET("/:id", cfg.DeviceHandler.GetDevice)
+	devices.PUT("/:id", cfg.DeviceHandler.UpdateDevice)
+	devices.DELETE("/:id", cfg.DeviceHandler.DeleteDevice)
+	devices.GET("/pending", cfg.DeviceHandler.ListPendingRegistrations)
+}