What adaptive mitigation mechanisms does Azure DDoS Protection deploy when shielding internet-facing workloads from massive, distributed volumetric and protocol attacks? Furthermore, why is continuously tuning traffic baselines against real-time telemetry the most reliable approach to neutralize malicious spikes while safeguarding legitimate application availability?