Function require_step_up 

pub async fn require_step_up(req: Request, next: Next) -> Response

Axum middleware, inside require_operator: the session’s last password or passkey check must be within the last five minutes (kernel spec §3.4), or the answer is 403 step_up_required and the client asks again.