Layer the auth gate onto an axum Router, independent of the
router’s own state type. Callsites in each router builder use this
to share one implementation. The gate is wrapped in Arc once so
every route on the router observes the same snapshot, even after
post-startup env-var changes.