[Auth] Move the REST request handlers onto the typed auth context

## Objective

Put the AuthenticatedUser and AuthenticatedKeypair dataclasses themselves on the request, and move the REST handlers from dictionary subscripts to attribute access.

## Background

Split out of BA-7173, which builds the two dataclasses and narrows the credential query. To keep that change reviewable, its middleware serializes them back into request["user"] and request["keypair"] with dataclasses.asdict, so no reader has to move yet. This issue removes that serialization.

About 170 sites subscript those two keys — role (50), domain_name (34), access_key (34), resource_policy (24), uuid (16), email (9), sudo_session_enabled (4), rate_limit (1) — concentrated in api/rest/session/, api/rest/vfolder/, api/rest/service/, dto/context.py and the TOTP plugin.

## Acceptance Criteria

- The middleware puts the dataclasses on the request; the asdict serialization is gone.
- Every request["user"] / request["keypair"] subscript in the REST layer becomes attribute access.
- Where a resource policy still flows into code typed Mapping[str, Any], the conversion happens at the call site rather than in the request.
- The legacy Graphene context keeps working through a single serialization in api/rest/admin/handler.py, which BA-7188 removes.
- Unit and component suites stay green.

## Related

- BA-7173 — the types, the credential query and the middleware; this issue stacks on it.
- BA-7188 — the legacy GraphQL context; stacks on this issue.

JIRA Issue: BA-7189

Start by reviewing the middleware from BA-7173 and searching request["user"] and request["keypair"] uses in api/rest/session/, api/rest/vfolder/, api/rest/service/, dto/context.py, and the TOTP plugin. Check api/rest/admin/handler.py for the legacy Graphene serialization, then run the unit and component suites; done means all REST access uses attributes while the legacy context still works.

Written by the indexing model from the issue text.