Reject missing authenticated users during auth

[suguanYang]

Summary

• Return UNAUTHENTICATED at the JWT auth boundary when a Dashboard/Internal token resolves to a user id missing from the user table.
• Leave API-key authentication on its existing validation/cache path.
• Keep normal missing-balance initialization for existing users in the billing service.
• Add a job creation contract test covering a valid JWT with missing authenticated user state that must not create a job or leak database errors.

Closes #27.

Tests

• uv run --all-packages pytest apps/api/tests/contract/test_job_creation_contract.py::test_should_reject_authenticated_user_id_missing_from_user_table apps/api/tests/contract/test_billing_contract.py::test_should_initialize_missing_user_balance_during_tier_lookup apps/api/tests/contract/test_billing_contract.py::test_should_initialize_missing_user_balance_once_for_concurrent_requests
• uv run --all-packages pytest apps/api/tests/contract/test_job_creation_contract.py apps/api/tests/contract/test_billing_contract.py
• uv run --all-packages pytest apps/worker/tests/contract/test_parse_task_contract.py::test_should_parse_a_pending_file_job_and_persist_the_published_result_state
• uv run --all-packages --group lint ruff check apps/api/app/core/dependencies.py packages/shared-python/shared/services/billing/credits_service.py packages/shared-python/shared/services/billing/credits_sync_service.py apps/api/tests/contract/test_job_creation_contract.py
• git diff --check
• uv run --all-packages --group typecheck pyright --project pyproject.toml apps/api/app apps/api/main.py apps/worker/app apps/worker/worker.py packages/shared-python/shared