move async to a run-time dependency

data-sources/db.js includes test-data/import.js, which uses async, so it
isn't just a dev dependency, its a run-time.