Next.js API Route With Authentication

**Context**: 
You are tasked with designing a secure API route using Next.js, a popular React framework for building server-side rendered and statically generated websites and applications. The API route should handle authentication, ensuring that only authorized users can access protected endpoints. You will be using a JSON Web Token (JWT) based authentication system.

**Detailed Instructions**: 
Create a Next.js API route that integrates authentication using JSON Web Tokens (JWT). The route should have the following functionalities:
1. **Authentication Endpoint**: Design an endpoint (`/api/auth/login`) that accepts a JSON payload with `username` and `password` and returns a JWT token upon successful authentication.
2. **Protected Endpoint**: Create a protected endpoint (`/api/protected`) that can only be accessed with a valid JWT token. This endpoint should return a success message if the token is valid.
3. **Token Verification**: Implement token verification using a secret key. The verification should check the token's expiration and validity.
4. **Error Handling**: Handle errors and return appropriate HTTP status codes for authentication failures, expired tokens, and invalid tokens.
5. **Integration with Next.js**: Ensure the API routes are properly integrated with Next.js, utilizing its built-in API route features.

**Output Format**: 
The output should include:
- The code for the authentication endpoint (`/api/auth/login`)
- The code for the protected endpoint (`/api/protected`)
- An explanation of how token verification is implemented
- Examples of successful and failed authentication attempts, including the request and response bodies

**Examples**: 
- Successful Login:
  - Request: `POST /api/auth/login` with JSON body `{ "username": "user123", "password": "pass123" }`
  - Response: `{ "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c" }`
- Failed Login (Invalid Credentials):
  - Request: `POST /api/auth/login` with JSON body `{ "username": "wronguser", "password": "wrongpass" }`
  - Response: `{ "error": "Invalid username or password" }` with a 401 status code
- Accessing Protected Endpoint with Valid Token:
  - Request: `GET /api/protected` with Header `Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c`
  - Response: `{ "message": "Welcome, you are authenticated" }`