refactor: convert FastAPI dependencies to async

[marius-mather]

Description

Convert some of our FastAPI dependencies to async (particularly where we might do API calls) to minimize the chances requests get blocked waiting for API requests. This may not provide a huge speedup but is a relatively easy win (and could provide further benefit if we make our DB/Auth0 calls async in future).

Changes

• Convert our JWT/authentication dependencies to async
• Update tests to account for async

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have added unit / integration tests that prove my fix is effective or that my feature works
• I have run all tests locally and they pass
• I have updated the documentation (if applicable)
• For any new secrets, I have updated the shared spreadsheet and the GitHub Secrets.

How to Test Manually (if necessary)

Run uv run pytest

[Copilot]

Pull request overview

This PR refactors the authentication/JWT FastAPI dependency chain to be async, enabling non-blocking JWKS/Auth0 network calls and aligning the test suite with the new async behavior.

Changes:

• Converted JWT verification + JWKS retrieval in auth/validator.py to async using httpx.AsyncClient.
• Updated the session-user dependency in auth/user_permissions.py (and downstream call sites) to await JWT verification.
• Updated affected tests to use AsyncMock and async test patterns.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
auth/validator.py	Makes verify_jwt / JWKS fetch async and swaps cache locking to an async lock.
auth/user_permissions.py	Converts get_session_user dependency to async and awaits JWT verification.
db/st_admin.py	Awaits async verify_jwt during the Auth0 admin callback flow.
tests/auth/test_auth_validator.py	Migrates JWT/JWKS tests to async and updates concurrency test to asyncio tasks.
tests/test_user.py	Updates mocks for async JWT/session-user dependencies.
tests/db/test_db_admin.py	Updates mocks for async verify_jwt in admin callback tests.

[amandazhuyilan]

I love async!