Document process-local auth session cache semantics

Clarify that dependencies.py session cache is process-local and not cluster-safe, and document the limitation in architecture docs.

backend/app/dependencies.py

@@ -46,6 +46,10 @@ _COOKIE_NAME = "bangui_session"
 #: How long (seconds) a validated session token is served from the in-memory
 #: cache without re-querying SQLite.  Eliminates repeated DB lookups for the
 #: same token arriving in near-simultaneous parallel requests.
+#:
+#: NOTE: this cache is process-local and is not cluster-safe. In multi-worker
+#: or distributed deployments, each process maintains its own cache, so logout
+#: invalidation and revocation may be delayed unless a shared cache is used.
 _SESSION_CACHE_TTL: float = 10.0
 
 #: ``token → (Session, cache_expiry_monotonic_time)``
@@ -56,6 +60,7 @@ def clear_session_cache() -> None:
     """Flush the entire in-memory session validation cache.
 
     Useful in tests to prevent stale state from leaking between test cases.
+    This only affects the current process.
     """
     _session_cache.clear()
 
@@ -64,7 +69,9 @@ def invalidate_session_cache(token: str) -> None:
     """Evict *token* from the in-memory session cache.
 
     Must be called during logout so the revoked token is no longer served
-    from cache without a DB round-trip.
+    from cache without a DB round-trip. This invalidation is local to the
+    current process; a clustered deployment would need a shared cache for
+    global invalidation.
 
     Args:
         token: The session token to remove.