api: move code out of app.api.js

Add api/boot/authentication.js to enable authentication once we are
ready for that.

Add api/boot/change-tracking.js to expose Todo's ChangeModel.
api: Move config of api path to app.local.json

Add `api/app.json` and `api/app.local.json` to configure the api server.

Modify api/app.api.js to load these config files via loopback-boot
and use `server.get('restApiRoot')` instead of `CONFIG.api.root`.