Function extract_api_key 

pub fn extract_api_key(headers: &HeaderMap) -> Result<&str, CredentialError>

Extract exactly one API key or Bearer credential.

Errors

Rejects missing, duplicate, or ambiguous credentials.