Refactor: Declare API routes in routes.json

[taylortom]

Currently initRoutes() manually creates route objects, registers them with the router, and secures each one individually (~60 lines). With loadRouteConfig now available from adapt-authoring-server v2.1.0, the 4 static API routes (preview, publish, import, export) can be declared in routes.json instead.

Benefits

• Route definitions (paths, handlers, permissions) in one place
• Consistent with the routes.json pattern used by api and auth modules
• Reduces imperative code in initRoutes()

Notes

• The root preview route (/preview/:id/{*splat}) stays imperative — it has custom error handling
• The conditional /update route stays imperative — it depends on enableUpdateApi config
• API metadata (meta) from apidefs.js applied after loading to keep JSON clean
• Server peerDependency needs bumping to ^2.1.0

Refs adapt-security/adapt-authoring-server#58, adapt-security/adapt-authoring-api#77