Function is_admin 

pub fn is_admin(auth: &AuthCtx) -> bool

True iff auth carries the site-admin (SADM) role.

Single source of truth for the role-name string; callers must not compare role strings inline.