JSON API endpoints for frontend/backend communication.

Routes should only handle HTTP concerns and call controllers, never services directly.