fix(api): require authentication for case reads

[aoto-tech]

I hit this while reviewing the case API and reported it to the maintainers by email first. The list and detail handlers were the only case routes that did not call require_permission, so requests without a token reached the repository layer.

I added require_permission("cases", "read") to both handlers and updated the existing case tests to use an admin token. I also added a test that checks both GET routes return 401 without authentication.

pytest core/tests/test_api_routers/test_cases.py -q -k require_authentication passes with 2 tests. compileall and git diff --check pass too. I tried the full case test file, but Docker Desktop was not running, so testcontainers failed while starting PostgreSQL before the tests ran.

Closes #147