Function router_with_auth 

pub fn router_with_auth(
    state: SoloHttpState,
    bearer_token: Option<String>,
) -> Router

Build the router with optional bearer-token auth.

When bearer_token is Some(t), every request except GET /health (the unauthenticated liveness probe) requires Authorization: Bearer t. The /health exemption keeps load balancers and uptime monitors from needing a credential.

tower_http::validate_request::ValidateRequestHeaderLayer::bearer returns 401 with a WWW-Authenticate header on missing/wrong token.