Assign Carrier Application

``AsclepiusApiView`` base for public-facing endpoints: accepts THREE public principals via a single composite authenticator (:class:`PublicFacingAuthentication`). The three accepted principals, each with its issuer/provider: 1. **Vitable-signed JWT** — a JWT issued and signed by Vitable (SimpleJWT / the ``VitableJWTAuthentication`` verifier); the raw ``eyJ…`` bearer authenticates a ``BaseUser``. 2. **Vitable API key** — a ``vit_apk_`` long-lived key (and its ``vit_at_`` short-lived access token), issued and verified via **Unkey** (``UnkeyAPIKeyManagerClient``); authenticates an org-scoped API principal (``APIKeyAuthInfo``). 3. **WorkOS-signed JWT** — a JWT issued and signed by **WorkOS** (the identity provider), via ``ProvisionedIdentityProviderBearerAuthentication``; authenticates a provisioned ``BaseUser``. Routing is by token prefix first (``vit_apk_`` / ``vit_at_`` → Unkey), then by JWT issuer for everything else (WorkOS IdP vs Vitable). Only ``get_authenticators`` changes versus ``AsclepiusApiView``: instead of the API-key facade plus the default JWT authenticators, the single composite authenticator does all the routing. Everything else is inherited unchanged — ``permission_classes = [IsAuthenticated]``, the JSON parser, ``allow_access_tokens``, and the ``vit_at_`` bound-token scope enforcement in ``initial`` (a no-op unless ``request.auth`` is an ``APIKeyAuthInfo``, so it stays correct for the two JWT principals). This base is intended for reuse by ANY public-facing controller. It establishes only *who* the caller is — it does NOT authorize *what* they may access. Every reusing controller MUST enforce its own authorization (tenant/org scoping, cross-tenant 404s, admin bypass), exactly as ``EmployersCollectionController`` derives the organization from the authenticated principal. In particular the Vitable-signed-JWT and WorkOS paths authenticate a ``BaseUser`` with no ``user_type`` gate here, so a controller that reuses this view without its own authorization check would accept any authenticated principal.