Function router 

pub fn router<S, F>(state: Arc<WorkflowCtx<S>>, gate: F) -> Router
where
    S: WorkflowStore,
    F: FnOnce(Router<Arc<WorkflowCtx<S>>>) -> Router<Arc<WorkflowCtx<S>>>,

Build the workflow HTTP API router. The gate argument is the wire-boundary auth layer; the embedder supplies it as a closure that wraps the authed portion of the router (typically |r| r.layer(my_auth_middleware)). The type signature makes the gate non-optional — you cannot construct an unauthenticated workflow router.

The closure receives only the authed portion. health, version, openapi.json, and docs are merged outside the gate so probes can reach them without a bearer token.