Module middleware 

Multi-strategy authentication middleware.

Checks in order:

1. Authorization: Bearer <token> header → matches file-based API token
2. tuitbot_session cookie → SHA-256 hash lookup in sessions table
3. Neither → 401 Unauthorized

For cookie-authenticated requests, mutating methods (POST/PATCH/DELETE/PUT) require a valid X-CSRF-Token header matching the session’s CSRF token.

Functions

auth_middleware

Axum middleware that enforces multi-strategy authentication.