Build the workflow HTTP API router. The gate argument is the
wire-boundary auth layer; the embedder supplies it as a closure
that wraps the authed portion of the router (typically
|r| r.layer(my_auth_middleware)). The type signature makes the
gate non-optional — you cannot construct an unauthenticated
workflow router.