API: add opt-in per-token auth identity cache

[MrDirkelz]

Every REST request through AuthGuard re-runs the full identity pipeline (RS256 verify + 3-4 Mango user lookups + a lastLogin write + accessMap projection). The socket handshake amortizes this per connection; the REST path does not, so a busy authenticated client hammers resolveIdentity and the DB.

Add IdentityCacheService, a transport-agnostic cache in front of AuthIdentityService.resolveOrDefault, used by both the REST guard and the socket handshake. It caches the resolved membership + identity keyed by a sha256 of the token and re-derives the accessMap live from PermissionSystem on each hit, so an ACL (groupUpdate) change needs no invalidation.

Design notes:

• TTL = min(token exp, IDENTITY_CACHE_TTL_MS): a hit never serves a token past expiry; a different/expired token misses and is fully verified.
• Bounded by a maxEntries cap + lazy/sweep eviction, no timers (BoundedTtlCache, reusing the strikeLimiter pattern).
• Invalidate on User memberOf removal (PermissionChange DeleteCmd), AuthProvider/AutoGroupMappings changes, and DB disconnect. Not on groupUpdate (accessMap is re-projected) or plain User updates, so lastLogin writes never evict.
• lastLogin now updates once per TTL per instance instead of per request.
• Ships disabled (IDENTITY_CACHE_ENABLED=false); enable per environment.
• Keeps all auth resolution behind one seam, easing a future SSE transport.

NOTE ON THE FOLLOWING DIAGRAM:
The accessMap is not cached in the current code, this part of the plan is just if we decide we want to deduplicate accessMaps that can be the same like super-admin access

flowchart TB
    A(["/query arrives with token"]) --> C{"IDENTITY<br>lookup token?"}
    C -- if found --> D["got mergedGroups<br>skip verify + DB + lastLogin"]
    C -- else --> E["resolveIdentity:<br>verify, DB lookups, lastLogin<br>store in identity cache under token"]
    D --> F["key2 = hash sorted mergedGroups"]
    E --> F
    F --> G{"Access map caching<br>lookup key2?"}
    G -- if found --> H["got shared accessMap<br>skip projection"]
    G -- else --> I["getAccessMap mergedGroups<br>store under key2<br>link key1 → key2"]
    H --> J["QueryService injects filters<br>run query"]
    I --> J
    J --> K(["return results"])
    E1["event: User.memberOf change"] --> A1@{ label: "Evict that identity's Layer I entry<br>NOTE: ignore lastLogin-only changes" }
    E2["event: AutoGroupMappings /<br>AuthProvider change"] --> A2["Full flush of Identity Cache"]
    E3["event: groupUpdate"] --> A3["Recompute each distinct projection<br>diff vs cached, update in place<br>linked tokens auto-update"]
    E4["event: DB disconnect"] --> A4["Clear BOTH caches"]
    A1 --> L1[("Identity Cache<br>token → membership")]
    A2 --> L1
    A4 --> L1 & L2[("Access map cache<br>membership-set → accessMap")]
    A3 --> L2

    A1@{ shape: rect}

Loading

[MrDirkelz]

@claude review this PR