Function required_capability 

pub fn required_capability(
    method: &Method,
    matched_path: &str,
) -> RequiredCapability

Map a matched route (method + axum MatchedPath) to its required capability (spec §3 table).

Keyed on the full nested MatchedPath (confirmed against the real router structure) plus the HTTP method, because one path can require different capabilities per method (e.g. GET /api/v1/sessions = read, POST = manage).

Unknown routes fail closed to RequiredCapability::Authenticated: an unmapped route still requires a valid token, never less than that.