Plug handling :local (IP-restricted, project from header/opts) and :bearer (Guardian JWT) auth modes. Sets :arke_project on conn assigns.