Function claims_have_admin_scope 

pub fn claims_have_admin_scope(claims: &DkodClaims) -> bool

Returns true when claims.scope equals "admin" or contains the word "admin" (space-separated scopes).

Callers must pass claims that have already been fully verified (signature + expiry) by AuthConfig::validate. Never call this with claims obtained via an insecure decode path.