Null Is Admin And Anon

A permission helper returns the same sentinel value for "caller is administrator" and "caller is unauthenticated". The function carries the sentinel's two meanings in inline comments rather than in the type system. Every downstream consumer reads the sentinel as "allow" because that is what the admin case meant. The unauthenticated visitor inherits admin trust by sharing the sentinel.