authenticatePrincipal resolves the caller's identity once across all
three credential kinds (admin API key, user API key, bearer session)
and returns a *Principal. requireAuth now delegates to it instead of
calling authenticate() which threw the resolved identity away.

Router updated to _, err := r.h.requireAuth(...). Nil-auth guard moved
before the API-key path so a missing auth service fails closed (401)
rather than falling through. Dead userIface/userFields locals removed.

TestRequireAuth_* tests extended to assert the returned Principal (Kind,
Role, UserID, Session pointer) for each credential type.

Extract principalFromUserAPIKey and principalFromBearerToken helpers
from authenticatePrincipal to bring its cyclomatic complexity from 11
down to 4, passing the gocyclo <=10 gate.

…I-key and nil-auth paths (refs #194)

When ValidateUserAPIKeyAPI returns a userRaw value whose concrete type does
not satisfy the GetID/GetEmail/GetRole interface, principalFromUserAPIKey
previously returned a partially-populated Principal (Role:"user", empty
UserID/Email). Any handler trusting the Principal would have granted access
to an unresolved identity. Fix: return nil (deny) when the assertion fails.

Adds three tests:
- TestRequireAuth_UserAPIKey: valid user API key yields PrincipalUserAPIKey
  with populated UserID/Email/Role (zero coverage on the #178 hot-spot).
- TestRequireAuth_UserAPIKey_BadRecord: unexpected userRaw type yields 401;
  fails pre-fix (Principal returned), passes post-fix (nil returned).
- TestRequireAuth_NilAuth_Rejects: Handler with auth==nil returns 401 for
  a non-admin key, confirming the fail-closed nil-auth branch.