pub fn build_admin_router(state: Arc<AppState>) -> Router
Dedicated management listener: excludes all EST enrollment routes.