pub fn is_admin(token: &str) -> bool
Check if a requester has admin privileges. In production, this would check an admin token or mTLS client cert.