Function require_auth 

pub async fn require_auth(request: Request, next: Next) -> Response

Validate the bearer token against EMBACLE_API_KEY.

The variable is read on every request, so a key can be rotated without a restart. Unset means every request passes — development mode, and the reason resolve_startup_auth exists to refuse that on a reachable bind.