router: register SidecarHandler routes for system config and device sidecar

Phase 1: Register routes that were defined but never connected

- Add GET/PUT /api/system/config routes (admin-only) for system
  configuration in new internal/router/system.go
- Add GET /api/devices/:id/sidecar routes for device sidecar config
- Add SidecarHandler to router Config struct
- Instantiate SidecarHandler in main.go with config for fallback support

These routes were implemented in handlers/sidecar.go but never registered,
breaking the ability to configure base URLs for device sync.

internal/router/device.go

@@ -26,4 +26,8 @@ func registerDeviceRoutes(cfg *Config) {
 	devices.GET("/pending", cfg.DeviceHandler.ListPendingRegistrations)
 	devices.GET("/approve/:registration_id", cfg.DeviceHandler.ApproveDevice)
 	devices.POST("/reject/:registration_id", cfg.DeviceHandler.RejectDevice)
+
+	// Device sidecar configuration routes
+	devices.GET("/:id/sidecar", cfg.SidecarHandler.GetSidecarConfig)
+	devices.GET("/:id/sidecar/download", cfg.SidecarHandler.DownloadSidecarConfig)
 }