Function has_role 

pub fn has_role(token: &str, role: &str) -> bool

Returns true when the token’s realm_access.roles claim contains role. Any JWT-decode failure or missing claim returns false — callers want a yes/no answer, and downstream BearerToken extraction is the auth boundary that surfaces the underlying 401.

Used by is_user_admin and by the server’s auth_middleware::read_only_guard.