fix(relay): satisfy clippy on admin auth changes

`authorize_request` returned `Result<(), Response>`, tripping
`clippy::result_large_err` (the axum `Response` Err variant is >=128
bytes). Return `ApiError` instead and convert at the two call sites.

Also drops a redundant closure in the config test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Eli Foster <efoster@squareup.com>

crates/buzz-relay/src/api/admin/mod.rs

@@ -1,7 +1,7 @@
 //! Private, read-only deployment moderation API.
 
 mod auth;
-mod error;
+pub(crate) mod error;
 
 use std::sync::Arc;
 
@@ -27,8 +27,8 @@ pub(crate) fn is_admin_host(state: &crate::state::AppState, headers: &HeaderMap)
 pub(crate) fn authorize_request(
     state: &crate::state::AppState,
     headers: &HeaderMap,
-) -> Result<(), Response> {
-    authorize(state, headers).map_err(|error| error.into_response())
+) -> Result<(), ApiError> {
+    authorize(state, headers)
 }
 
 /// Build the read-only deployment-admin routes.

crates/buzz-relay/src/config.rs

@@ -1119,7 +1119,7 @@ mod tests {
             "BUZZ_ADMIN_PASSWORD",
             "BUZZ_ADMIN_WEB_DIR",
         ];
-        let previous = NAMES.map(|name| std::env::var_os(name));
+        let previous = NAMES.map(std::env::var_os);
         for name in NAMES {
             std::env::remove_var(name);
         }

crates/buzz-relay/src/router.rs

@@ -161,8 +161,8 @@ pub fn build_router(state: Arc<AppState>) -> Router {
                 let path = req.uri().path();
                 let admin_host = api::admin::is_admin_host(&state, req.headers());
                 if admin_host {
-                    if let Err(response) = api::admin::authorize_request(&state, req.headers()) {
-                        return Ok(response);
+                    if let Err(error) = api::admin::authorize_request(&state, req.headers()) {
+                        return Ok(error.into_response());
                     }
                     if let (Some(index), Some(files)) = (admin_index, admin_files) {
                         if path.starts_with("/assets/") {
@@ -274,8 +274,8 @@ async fn nip11_or_ws_handler(
     // Short-circuit the exact admin authority here and never let it serve the
     // public web bundle, NIP-11 document, or WebSocket endpoint.
     if api::admin::is_admin_host(&state, &headers) {
-        if let Err(response) = api::admin::authorize_request(&state, &headers) {
-            return response;
+        if let Err(error) = api::admin::authorize_request(&state, &headers) {
+            return error.into_response();
         }
         if !accept.contains("text/html") {
             return StatusCode::NOT_FOUND.into_response();