/api/items (list all items)