Add resource routes and signed writes

src/app.ts

@@ -6,6 +6,7 @@ import { HttpTransportRouter } from './services/transport/http-transport.ts';
 import { WsTransportRouter } from './services/transport/ws-transport.ts';
 import { ServerHost } from './services/server-host.ts';
 import { Logger } from './utils/logger.ts';
+import { DataRoute } from './routes/resources.ts';
 
 /** Application composition root. */
 export class App {
@@ -24,13 +25,19 @@ export class App {
 
         // Domain services are shared across all transports and route modules.
         const broadcaster = new Broadcaster(debug);
-        const routes = [];
+        const routes = [
+            // DataRoute owns resource read/write/subscribe logic and maps resource
+            // ids to broadcaster topics. timestampWindowMs controls write replay protection.
+            new DataRoute(database, broadcaster, config.auth.timestampWindowMs),
+        ];
 
         // Route loading is an explicit startup phase, not first-request work.
         // ApplicationRouter.create validates every path and rejects duplicates
         // before any client can connect.
         const router = await ApplicationRouter.create(routes);
 
+        // Both transports share one ApplicationRouter. Routes use the shared
+        // Broadcaster directly, while HTTP and WebSocket remain protocol adapters.
         const http = new HttpTransportRouter(router, debug);
         const ws = new WsTransportRouter(router, debug, config.server.maxRequestBodyBytes);
         const host = new ServerHost(config, debug, [http, ws]);