Module auth 

Bearer token authentication.

The server requires Authorization: Bearer <token> on every route. Tokens are loaded from CELLOS_SERVER_API_TOKEN at startup; the server refuses to start if the env var is unset. Constant-time compare avoids leaking length/prefix information via timing.

Functions

require_bearer

Verify the incoming Authorization header against the configured token. Returns Ok(()) on match, RFC-9457 Unauthorized otherwise.