The current auth middleware is doing too much. Split into separate concerns: token validation, role check, rate limit.
Task createdabout 4 hours ago