chore: relocate backend into apps/api ahead of monorepo merge

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/api/routes/staff/staff.routes.js

@@ -0,0 +1,33 @@
+/***********************************************************************************************************************************************************************
+ * File Name: staff.routes.js
+ * Type of Program: Router
+ * Description: Protected routes accessible by staff and admin only.
+ *              Staff can view non-admin users and toggle their status.
+ *              Staff cannot view or modify admins.
+ *
+ * Route Map:
+ *   GET  /api/staff/users                    → paginated user list (non-admins)
+ *   GET  /api/staff/users/:id                → view a specific non-admin user
+ *   PUT  /api/staff/users/:id/status         → activate or deactivate a user
+ *   GET  /api/staff/users/:id/sessions       → view user's sessions
+ *
+ * Guards: authenticate → requireStaff()
+ *
+ * Author: rgrgogu
+ * Date Created: Oct. 6, 2025
+ ***********************************************************************************************************************************************************************/
+const express   = require('express');
+const router    = express.Router();
+
+const usersCtrl = require('../../controllers/staff/users.controller');
+const { authenticate } = require('../../middleware/auth.middleware');
+const { requireStaff } = require('../../middleware/rbac.middleware');
+
+router.use(authenticate, requireStaff());
+
+router.get('/users/',                       usersCtrl.getUsers);
+router.get('/users/:id',                    usersCtrl.getUser);
+router.put('/users/:id/status',             usersCtrl.setUserStatus);
+router.get('/users/:id/sessions',           usersCtrl.getUserSessions);
+
+module.exports = router;