perf(tokens): add in-memory verification cache with 5min TTL

Token verification previously ran Argon2id + disk read on every
authenticated request. Under load this becomes the bottleneck
(~100ms per Argon2 verify on a single core).

Changes:
- Add in-memory cache (SHA256 -> user/role/expiry) with 5 minute TTL
- Defer last_used timestamp writes to batch flush every 30 seconds
- Invalidate cache entry on token revoke
- Background task flushes pending last_used alongside metrics persist

First verify_token call per token: full Argon2 + disk (unchanged).
Subsequent calls within TTL: HashMap lookup only (sub-microsecond).

nora-registry/src/main.rs

@@ -430,13 +430,16 @@ async fn run_server(config: Config, storage: Storage) {
         "Available endpoints"
     );
 
-    // Background task: persist metrics every 30 seconds
+    // Background task: persist metrics and flush token last_used every 30 seconds
     let metrics_state = state.clone();
     tokio::spawn(async move {
         let mut interval = tokio::time::interval(std::time::Duration::from_secs(30));
         loop {
             interval.tick().await;
             metrics_state.metrics.save();
+            if let Some(ref token_store) = metrics_state.tokens {
+                token_store.flush_last_used();
+            }
         }
     });