Fix get user from request blocks loop

[bhtabor]

Fix get user from request blocks loop

[chriscarrollsmith]

Follow-up from review:

• Filed Document sync-Session + async-route pattern; add optional AsyncSession dependency #237 to document the sync-Session + rare-async-route pattern and optionally add an AsyncSession dependency.
• Pushing a follow-up commit on this branch for:
  • safer update_profile (offload CPU-only image work; keep Session/ORM mutations out of the thread pool)
  • convert remaining falsely-async leftovers (read_static_page, read_home)
  • typed _run_async test helper