pub fn require_admin(req: &HttpRequest) -> Result<(), AppError>Expand description
Verify the request carries a valid admin token.
Returns Err(AppError::Forbidden) when the token is missing, malformed,
or does not match. Returns Err(AppError::Forbidden) (not 500) when the
server has no ADMIN_TOKEN configured at all — admin endpoints stay
disabled by default.