Function require_bearer 

pub fn require_bearer(
    headers: &HeaderMap,
    expected: &str,
) -> Result<(), AppError>

Verify the incoming Authorization header against the configured token. Returns Ok(()) on match, RFC-9457 Unauthorized otherwise.