Function http_authz 

async fn http_authz(
    req: Request,
    next: Next,
) -> Result<impl IntoResponse, AuthError>

Authorization middleware. Enforces the route group’s allowed_roles policy against the authenticated user.

Layered immediately inside http_auth on every authenticated route group, always paired with a RouteAllowedRoles extension. By that wiring both the AuthedUser (from http_auth) and the RouteAllowedRoles extension are present whenever this runs. A missing extension is a wiring bug, so we fail closed rather than skip the check.