POST /auth/login
GET /auth/me (protected)
GET /posts (public)
GET /posts/:id (public)
POST /posts (protected)
PUT /posts/:id (protected)
GET /stats (public)
GET /stats/:id (public)
POST /tours (protected)
PUT /tours/:id (protected)
DELETE /tours/:id (protected)