fix(auth): make require_auth async so the user ContextVar reaches the endpoint (#485)

Fixes #481. Makes `require_auth` and `require_admin` `async def` so the user ContextVar set inside the dep is visible to async endpoints; sync deps run via `anyio.to_thread.run_sync` under `copy_context()` and the set is discarded on return.