Auth refactor 8/10 — Migrate plain-session services, batch B

[pranavp10]

This ticket was generated by AI (to-tickets) from #43.

Parent

#43

What to build

The second batch of plain-session service migrations, following the pilot recipe (#49) and parallelizable with batch A (#50). Suggested batch: template, api-key, workflow, and any remaining plain-session services (final split adjustable at implementation time).

Acceptance criteria

• Each service in the batch mounts @reloop/auth/middleware with injected config
• Each service's old auth middleware file(s) deleted
• Handlers use the canonical AuthContext; fail-closed default applied, org-optional routes use authNoOrg
• Smoke test per service (protected endpoint + API-key call where applicable)
• Tripwire (Auth refactor 1/10 — Test harness + characterization tripwire #44) still passes; all migrated services build green

Blocked by

• Auth refactor 6/10 — Pilot migration (one low-risk service) #49