Protect returns a middleware that, when enabled, requires authentication on
/v1/api/* and /v1/workspace/*, except for /v1/api/auth/* and OPTIONS.
It accepts either a valid cookie session (local/bff) or, when mode includes
oidc, a Bearer token (TODO: integrate Datly auth validation).