fix(relay): satisfy clippy lint warnings on admin auth changes

[elifoster-block]

Stacked on #4606 — targets codex/security-admin-host-origin-auth, not main.

#4606 fails Rust Lint and Windows Rust on two clippy errors under -D warnings. Neither is a real bug; both are style rules the repo enforces strictly enough to block a merge. No user-visible behavior changes.

1. clippy::result_large_err

crates/buzz-relay/src/api/admin/mod.rs:30

A Result is always sized to fit its larger variant, and it gets moved on every return — including the success path. authorize_request returned Result<(), Response>: nothing on success, a fully-built axum Response (≥128 bytes) on failure. So every successful admin request was carrying a 128-byte payload to deliver zero bytes.

The fix stops building the HTTP response inside that function. It now returns ApiError — a status code, two &'static str, and a bool — and the two router.rs call sites convert with .into_response() at the point they actually need a response. Same responses go out; the expensive object is constructed one frame later, only on the failure path.

admin::error was promoted to pub(crate) mod as bookkeeping for that: once a pub(crate) fn hands ApiError back, the type has to be nameable by its callers, or Rust flags it as a private interface leak.

2. clippy::redundant_closure

crates/buzz-relay/src/config.rs:1122, in a test.

NAMES.map(|name| std::env::var_os(name))   // closure whose only job is to forward its argument
NAMES.map(std::env::var_os)                // pass the function directly

Identical behavior, one less layer.

Why the two jobs reported different errors

Rust Lint (Linux) hit #1 and bailed before compiling the test target, so it never saw #2. Windows Rust compiles lib test and caught both.

Testing

Not built locally — no Rust toolchain on the authoring machine, so clippy never ran before push. Relying on CI. Staying a draft until Rust Lint and Windows Rust are green.