Function authorize 

async fn authorize(services: &State, caller: &UserId, target: &UserId) -> Result

MSC4323: ordered access control for the four admin endpoints.

Spec mandates: authorization MUST be checked before account lookups (anti-enumeration). The pure self-target check fails first; the three IO checks (admin gate + existence + admin-target) run concurrently; failures are then reported in spec-mandated priority.