Protected MixMan Coordinator mutation endpoints.

State and session changes now require fail-closed bearer authentication, while intended read-only diagnostics remain public.

• Issue: mixmancoordinator#1
• PR: PR #34