feat: implement CAS module, middleware, utils, and templates

- CAS: GET /files/{hash} with immutable cache headers, launcher asset
  serving, hash validation, StoreFile/VerifyAndStore helpers
- Middleware: CORS, request logging, per-IP token bucket rate limiter
- Utils: SHA1Bytes, SHA256Bytes, SHA1File, Unzip with zip-slip protection
- Templates: placeholder handler with html/template discovery
- Wire CAS routes and middleware chain (Logging → CORS) in main.go

cmd/server/main.go

@@ -13,8 +13,11 @@ import (
 	"gitea.mrixs.me/Mrixs/MrixsCraft-server/internal/admin"
 	"gitea.mrixs.me/Mrixs/MrixsCraft-server/internal/api"
 	"gitea.mrixs.me/Mrixs/MrixsCraft-server/internal/auth"
+	"gitea.mrixs.me/Mrixs/MrixsCraft-server/internal/cas"
 	"gitea.mrixs.me/Mrixs/MrixsCraft-server/internal/config"
 	"gitea.mrixs.me/Mrixs/MrixsCraft-server/internal/database"
+	"gitea.mrixs.me/Mrixs/MrixsCraft-server/internal/middleware"
+	"gitea.mrixs.me/Mrixs/MrixsCraft-server/internal/templates"
 )
 
 func main() {
@@ -33,7 +36,7 @@ func main() {
 
 	mux := http.NewServeMux()
 
-	// Health check.
+	// Health check — no auth needed.
 	mux.HandleFunc("GET /health", func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		w.Write([]byte("ok"))
@@ -47,16 +50,27 @@ func main() {
 	apiHandler := api.NewHandler(db, cfg)
 	apiHandler.RegisterRoutes(mux)
 
+	// CAS (Content-Addressable Storage) file serving.
+	casHandler := cas.NewHandler(db, cfg)
+	casHandler.RegisterRoutes(mux)
+
 	// Admin panel.
 	adminHandler := admin.NewHandler(db, cfg)
 	adminHandler.RegisterRoutes(mux)
 
-	// TODO: register CAS routes.
+	// Templates (web UI).
+	templatesHandler := templates.NewHandler(db, cfg)
+	templatesHandler.RegisterRoutes(mux)
+
+	// Wrapper chain: Logging → CORS → mux.
+	var handler http.Handler = mux
+	handler = middleware.CORS(handler)
+	handler = middleware.Logging(handler)
 
 	addr := ":" + itoa(cfg.Port)
 	srv := &http.Server{
 		Addr:    addr,
-		Handler: mux,
+		Handler: handler,
 	}
 
 	// Graceful shutdown.