pub async fn require_principal(req: Request, next: Next) -> Response
Auth-required layer: 401 unless a validated principal extension is on the request (fail closed — absence of auth information is never access).