router: register SidecarHandler routes for system config and device sidecar

Phase 1: Register routes that were defined but never connected

- Add GET/PUT /api/system/config routes (admin-only) for system
  configuration in new internal/router/system.go
- Add GET /api/devices/:id/sidecar routes for device sidecar config
- Add SidecarHandler to router Config struct
- Instantiate SidecarHandler in main.go with config for fallback support

These routes were implemented in handlers/sidecar.go but never registered,
breaking the ability to configure base URLs for device sync.

cmd/server/main.go

@@ -90,6 +90,7 @@ func main() {
 
 	authHandler := handlers.NewAuthHandler(queries, cfg.JWTSecret, loginAttemptTracker)
 	systemSettingsHandler := handlers.NewSystemSettingsHandler(queries)
+	sidecarHandler := handlers.NewSidecarHandler(queries, cfg)
 	libraryHandler := handlers.NewLibraryHandler(queries)
 	deviceHandler := handlers.NewDeviceHandler(queries, cfg.JWTSecret, cfg)
 	deviceAuthMiddleware := middleware.NewDeviceAuthMiddleware(queries)
@@ -182,6 +183,7 @@ func main() {
 		OPDSHandler:           opdsHandler,
 		Worker:                worker,
 		SystemSettingsHandler: systemSettingsHandler,
+		SidecarHandler:        sidecarHandler,
 		ConnManager:           connManager,
 		QueueProcessor:        queueProcessor,
 		DeviceAuthMiddleware:  deviceAuthMiddleware,

internal/router/device.go

@@ -26,4 +26,8 @@ func registerDeviceRoutes(cfg *Config) {
 	devices.GET("/pending", cfg.DeviceHandler.ListPendingRegistrations)
 	devices.GET("/approve/:registration_id", cfg.DeviceHandler.ApproveDevice)
 	devices.POST("/reject/:registration_id", cfg.DeviceHandler.RejectDevice)
+
+	// Device sidecar configuration routes
+	devices.GET("/:id/sidecar", cfg.SidecarHandler.GetSidecarConfig)
+	devices.GET("/:id/sidecar/download", cfg.SidecarHandler.DownloadSidecarConfig)
 }

internal/router/router.go

@@ -62,6 +62,7 @@ type Config struct {
 	LoginTracker          *ratelimit.LoginAttemptTracker
 	ScannerHandler        *handlers.Handler
 	JobsHandler           *handlers.JobsHandler
+	SidecarHandler        *handlers.SidecarHandler
 }
 
 // createJWTMiddleware creates a JWT middleware with proper user context setup
@@ -203,6 +204,7 @@ func RegisterRoutes(cfg *Config) *handlers.Handler {
 	registerAuthRoutes(cfg, rateLimitMiddleware)
 	registerLibraryRoutes(cfg)
 	registerDeviceRoutes(cfg)
+	registerSystemRoutes(cfg)
 	registerSyncRoutes(cfg)
 	registerCollectionsRoutes(cfg)
 	registerDashboardRoutes(cfg)

internal/router/system.go

@@ -0,0 +1,20 @@
+package router
+
+import (
+	"bookhoard/internal/handlers"
+)
+
+func registerSystemRoutes(cfg *Config) {
+	e := cfg.Echo
+
+	// JWT middleware
+	jwtMiddleware := createJWTMiddleware(cfg)
+
+	// Protected routes (admin-only)
+	protected := e.Group("/api", jwtMiddleware)
+	system := protected.Group("/system", handlers.AdminMiddleware)
+
+	// System configuration routes (admin-only)
+	system.GET("/config", cfg.SidecarHandler.GetSystemConfiguration)
+	system.PUT("/config", cfg.SidecarHandler.UpdateSystemConfiguration)
+}