Panel plane: service-token auth and snapshot route (#152)

api/app.py

@@ -8,6 +8,10 @@ exposes the two endpoints every later task depends on:
   app has imported core, opened the database, and applied migrations;
   a cheap ``SELECT 1`` confirms the connection is live without leaking
   the filesystem path on an unauthenticated route.
+- ``GET /api/v1/panel/snapshot`` — the panel plane's today snapshot
+  (service-token protected; see :mod:`api.routes_panel`, whose router
+  carries the shared :func:`api.dependencies.require_panel_token`
+  check).
 - ``GET /docs`` — FastAPI's auto-served OpenAPI document (Swagger UI);
   ``/openapi.json`` is the raw schema.  No extra wiring is needed;
   FastAPI serves both by default.
@@ -35,6 +39,7 @@ from fastapi import FastAPI
 
 from api.config import ApiConfig
 from api.database import DatabaseState, make_database
+from api.routes_panel import router as panel_router
 
 
 def _build_lifespan(db_path: str):
@@ -79,6 +84,12 @@ def create_app(config: ApiConfig | None = None) -> FastAPI:
         lifespan=_build_lifespan(cfg.db_path),
     )
 
+    # The resolved config rides on app.state so the reusable route
+    # dependencies (the panel service-token check) read the configured
+    # values from the app rather than module state.
+    app.state.config = cfg
+    app.include_router(panel_router)
+
     @app.get("/health", summary="Service health")
     async def health() -> dict[str, str]:
         """Return service health.