Move API routes to /api