Reduce per-request DB overhead (Task 4)

- Cache setup_completed flag in app.state._setup_complete_cached after
  first successful is_setup_complete() call; all subsequent API requests
  skip the DB query entirely (one-way transition, cleared on restart).
- Add in-memory session token TTL cache (10 s) in require_auth; the second
  request with the same token within the window skips session_repo.get_session.
- Call invalidate_session_cache() on logout so revoked tokens are evicted
  immediately rather than waiting for TTL expiry.
- Add clear_session_cache() for test isolation.
- 5 new tests covering the cached fast-path for both optimisations.
- 460 tests pass, 83% coverage, zero ruff/mypy warnings.

backend/app/routers/auth.py

@@ -12,7 +12,7 @@ from __future__ import annotations
 import structlog
 from fastapi import APIRouter, HTTPException, Request, Response, status
 
-from app.dependencies import DbDep, SettingsDep
+from app.dependencies import DbDep, SettingsDep, invalidate_session_cache
 from app.models.auth import LoginRequest, LoginResponse, LogoutResponse
 from app.services import auth_service
 
@@ -101,6 +101,7 @@ async def logout(
     token = _extract_token(request)
     if token:
         await auth_service.logout(db, token)
+        invalidate_session_cache(token)
     response.delete_cookie(key=_COOKIE_NAME)
     return LogoutResponse()