Function validate_hsm_group_access 

pub async fn validate_hsm_group_access(
    infra: &InfraContext<'_>,
    token: &str,
    group_name: &str,
) -> Result<(), Error>

Validate that group_name is in the set this token can access.

Used by handlers that perform privileged HSM-group operations and need a server-side authorization check before delegating to the service layer. Returns Error::BadRequest with a usable error message when the group is not accessible.