Function read_only_guard 

pub async fn read_only_guard(request: Request, next: Next) -> Response

Reject mutating requests when the caller’s bearer token carries the READ_ONLY_ROLE role. Read methods (GET, HEAD, OPTIONS, …) pass through unconditionally.

Missing or malformed tokens also pass through — the handler’s own super::handlers::BearerToken extractor produces the 401 it already does. This middleware is not the authentication boundary.

Layered in super::routes::build_router only on the /api/v1/* resource router, not on /api/v1/auth/* (login flow) and not on /docs (Swagger UI).