New pages silently unprotected: allowlist matcher protects listed routes only

# Symptom
A recently added page or API route is accessible without signing in, while older routes are protected.

# Confirm the cause
1. Read your middleware. If it says `if (isProtectedRoute(req)) { await auth.protect() }` with a list of protected paths, you have an allowlist. New routes are born unprotected.
2. Audit: pick three routes you believe are protected and request them with no session. Any 200 on a page that should require auth confirms it.

# Fix
- Invert the check: list only public routes, protect everything else.
  ```ts
  const isPublicRoute = createRouteMatcher(['/sign-in(.*)', '/sign-up(.*)', '/'])
  export default clerkMiddleware(async (auth, req) => {
    if (!isPublicRoute(req)) { await auth.protect() }
  })
  ```
- After inverting, re-audit the same three routes plus every route added in the last month.
- Keep server-side `auth()` checks inside route handlers and server components as a second layer; the middleware is not the only gate.

# Verify
Request every route in your sitemap signed-out. Protected pages redirect to sign-in; only the public list returns 200.