fix: APP-scoped httpx.AsyncClient instances are never closed

[rorybyrne]

The pattern from #5 (GEOIngestor's unclosed httpx.AsyncClient) survives in two DI providers, even though the original site was deleted with the source domain:

• server/osa/infrastructure/auth/di.py:70
• server/osa/infrastructure/http/di.py:31

Both create an httpx.AsyncClient at Scope.APP with no Dishka finalizer, so the connection pool is never closed on shutdown.

Fix

Make the providers async generators so Dishka runs the teardown:

@provide(scope=Scope.APP)
async def http_client(self) -> AsyncIterator[httpx.AsyncClient]:
    async with httpx.AsyncClient() as client:
        yield client

Found while verifying #5, which is closed as obsolete in favour of this issue.