Function require_admin 

pub fn require_admin(
    config: &dyn Config,
    headers: &HeaderMap,
) -> Result<(), Problem>

Checks Authorization: Bearer <ADMIN_TOKEN> for one admin request.

• ADMIN_TOKEN unset → Err(401 admin-unauthorized): the route is disabled, same answer as a missing header, so probing cannot tell whether admin is switched on.
• Missing/malformed header → Err(401 admin-unauthorized).
• Wrong token → Err(403 admin-forbidden).

Errors

The Problem described above; carry it straight into the handler’s Err.