feat: implement authentication routes with login, logout, and user info retrieval

feat: add S3 bucket versioning support and related XML response handling

refactor: rename temporary file paths from 'teleuploader' to 'filedrop' for consistency

fix: update Swagger documentation to reflect new API name and descriptions

test: add unit tests for authentication routes and utilities

test: implement end-to-end tests for S3 bucket configuration and versioning

chore: update environment variable defaults for new service name

src/routes/auth.ts

@@ -0,0 +1,64 @@
+import { config } from '../env';
+import {
+  checkBearerToken,
+  clearSessionCookie,
+  createSessionCookie,
+  getAuthSession,
+  isAuthEnabled,
+  timingSafeCompare,
+} from '../utils/auth';
+
+const json = (data: unknown, status = 200, headers: Record<string, string> = {}): Response =>
+  Response.json(data, { status, headers });
+
+const notFound = (): Response => json({ error: 'Not found' }, 404);
+
+const readLoginBody = async (req: Request): Promise<{ token: string } | null> => {
+  try {
+    const body = (await req.json()) as { token?: unknown };
+    if (typeof body.token !== 'string' || body.token.length === 0) return null;
+    return { token: body.token };
+  } catch {
+    return null;
+  }
+};
+
+export const handleLogin = async (req: Request): Promise<Response> => {
+  if (!isAuthEnabled()) return notFound();
+
+  const body = await readLoginBody(req);
+  if (!body) return json({ error: 'Token is required' }, 400);
+
+  if (!timingSafeCompare(body.token, config.adminApiToken)) {
+    return json({ error: 'Invalid token' }, 401);
+  }
+
+  return json({ username: 'admin' }, 200, {
+    'set-cookie': createSessionCookie('admin'),
+  });
+};
+
+export const handleLogout = async (): Promise<Response> =>
+  json({ success: true }, 200, {
+    'set-cookie': clearSessionCookie(),
+  });
+
+export const handleMe = async (req: Request): Promise<Response> => {
+  if (!isAuthEnabled()) return notFound();
+
+  const session = getAuthSession(req);
+  if (!session && !checkBearerToken(req.headers.get('authorization'))) {
+    return json({ error: 'Unauthorized' }, 401);
+  }
+
+  const activeSession = session ?? {
+    username: 'admin',
+    expiresAt: null,
+    method: 'bearer' as const,
+  };
+
+  return json({
+    username: activeSession.username,
+    expiresAt: activeSession.expiresAt?.toISOString() ?? null,
+  });
+};