Auth integration: Update router and wire up middleware

[jhrozek]

Update the router setup in cmd/thv-registry-api/api/v1/routes.go to use the auth middleware.

The router needs to separate public routes (/health, /docs/, /.well-known/oauth-protected-resource) from protected routes. Use Chi route groups to cleanly organize this. Whether /v0/ and /private/* are protected should come from the protectedPaths config.

Update cmd/thv-registry-api/main.go to initialize the ConfigManager from PR #47 and pass it to the router setup so we can read the auth config.

The RFC 9728 metadata handler should be mounted at /.well-known/oauth-protected-resource (this is always public).