fix: use route_service instead of fallback_service for MCP router (#8614)

fallback_service on a router with no explicit routes is invisible to
axum's nest() — requests never reach the nested fallback, resulting in
404s. route_service("/", service) registers an actual route so nest()
forwards correctly.

Also reverts layer back to route_layer for the ApiAuthed extractor
since there is now a real route to match against.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/windmill-api/src/lib.rs

@@ -475,17 +475,14 @@ pub async fn run_server(
             let (mcp_router, mcp_cancellation_token) =
                 setup_mcp_server(db.clone(), user_db, _base_internal_url.clone()).await?;
             // Workspace-scoped MCP router
-            // Use `layer` instead of `route_layer` because the MCP router only has
-            // a fallback_service (no explicit routes), and axum 0.8 panics on
-            // route_layer with no routes.
             let workspaced_mcp_router = mcp_router
                 .clone()
-                .layer(from_extractor::<ApiAuthed>())
+                .route_layer(from_extractor::<ApiAuthed>())
                 .layer(axum::middleware::from_fn(add_www_authenticate_header))
                 .layer(axum::middleware::from_fn(extract_and_store_workspace_id));
             // Gateway MCP router — resolves workspace from token
             let gateway_mcp_router = mcp_router
-                .layer(from_extractor::<ApiAuthed>())
+                .route_layer(from_extractor::<ApiAuthed>())
                 .layer(axum::middleware::from_fn(
                     add_www_authenticate_header_gateway,
                 ))

backend/windmill-api/src/mcp/core.rs

@@ -546,7 +546,7 @@ pub async fn setup_mcp_server(
     let service =
         StreamableHttpService::new(move || Ok(runner.clone()), session_manager, service_config);
 
-    let router = Router::new().fallback_service(service);
+    let router = Router::new().route_service("/", service);
     Ok((router, cancellation_token))
 }