feat: add AuthController, protect routes, move API to web middleware

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

routes/api.php

@@ -1,15 +1,5 @@
 <?php
 
-use App\Http\Controllers\IbadahController;
-use App\Http\Controllers\MiskinController;
 use Illuminate\Support\Facades\Route;
 
-Route::get('/ibadah', [IbadahController::class, 'index']);
-Route::post('/ibadah', [IbadahController::class, 'store']);
-Route::put('/ibadah/{id}', [IbadahController::class, 'update']);
-Route::delete('/ibadah/{id}', [IbadahController::class, 'destroy']);
-
-Route::get('/miskin', [MiskinController::class, 'index']);
-Route::post('/miskin', [MiskinController::class, 'store']);
-Route::put('/miskin/{id}', [MiskinController::class, 'update']);
-Route::delete('/miskin/{id}', [MiskinController::class, 'destroy']);
+// API routes are handled in routes/web.php under /api prefix with session auth