JSON API endpoints for frontend/backend communication.
Routes should only handle HTTP concerns and call controllers, never services directly.