Admin-only list of held-but-unused rdids (paginated, newest-stuck first)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.