Function app 

pub fn app(
    config: Arc<Config>,
    keys: Arc<KeyStore>,
    metering: Arc<Metering>,
    tenancy: Arc<Tenancy>,
) -> Router

Builds the served application: routes, then auth + metering around them.

The layering order is the one §4/§5 require — auth::metered is a route_layer, so a request is authenticated before it can reach a handler and a rejected one is answered without touching a database or appending a metering record.