Replace repeated GetUserId() boilerplate with a ClaimsPrincipal extension or endpoint filter #1606

Controllers repeat if (GetUserId() is not { } userId) return Unauthorized(); after [Authorize] already guarantees authentication, and the same claim lookup is repeated in Program.cs. Add a GetRequiredUserId() extension (or filter) and drop the dead 401 branches.

Found during review of #1267; intentionally kept out of that PR.