Function require_token 

pub(crate) async fn require_token(
    __arg0: State<Arc<AppState>>,
    req: Request,
    next: Next,
) -> Response

Bearer-token gate. In open mode every request passes. Otherwise: missing/blank Authorization -> 401; present but not an accepted token -> 403; a read-only token passes with a ReadOnly extension the write paths refuse. The token value is never logged.