refactor(relay): eliminate DRY violations across admin route handlers #24

Summary#

routes/auth.rs — extracts require_admin_token() to replace the 37-line Bearer token auth block that was copy-pasted verbatim into claim_codes, create_account, and create_signing_key; also fixes a pre-existing inconsistency in create_signing_key where inspect_err debug logging for non-UTF-8 auth headers was missing
routes/code_gen.rs — moves generate_code() + CODE_LEN/CHARSET constants here from claim_codes and create_account, where they were defined identically
routes/test_utils.rs — shares test_state_with_admin_token() instead of duplicating it in each route's test module
create_account — consolidates 4 pre-check uniqueness queries into 2 OR EXISTS queries (email and handle each now check both accounts+pending_accounts in a single round-trip); the cross-table checks remain load-bearing since SQLite has no cross-table FK enforcement

Net: 121 insertions, 187 deletions. All 185 tests pass.

cargo test passes (185 tests, 0 failures)
Auth: missing/wrong/bare token still returns 401 on all three admin endpoints
POST /v1/accounts still returns 409 for email duplicate in accounts table (cross-table check preserved)
POST /v1/accounts still returns 409 for handle duplicate in handles table (cross-table check preserved)