perf(auth): cache push_context's resolved user per session (#57)

[nycomp]

Fixes #57. Root cause of the slow authenticated pages in nyjc-computing/campus-profile#22 and a contributor to the campus-admin WORKER TIMEOUT incident (nyjc-computing/campus-admin#13).

What

push_context() runs as an app-wide before_request hook, so every request from a session-carrying browser paid 1–2 synchronous auth API calls before the route handler ran:

1. sessions.from_session() / logins.from_session()
2. users[user_id].get()

The resolved user is now cached in-process, keyed by ("session"|"login", session_id), for user_cache_ttl (instance attribute, default USER_CACHE_TTL_SECONDS = 60). A warm request makes zero upstream calls.

Semantics and trade-offs

• Freshness: a user's g.user may be up to 60s stale within the TTL window; user_id-keyed authorization is unaffected.
• Revocation lag: a session revoked server-side — not through logout() — keeps resolving for up to the TTL. Client-initiated logout evicts immediately, as do stale-session NotFoundError paths.
• No shared mutable state: the cache stores user.to_resource() and rehydrates a fresh campus.model.User per hit, so callers mutating flask.g.user cannot poison the cache.
• Multi-worker: each worker keeps its own small dict; races are benign (both threads fetch, last write wins), so no lock is held on the request path.
• Devices are cached with the login-session branch (g.device); the auth-session branch caches device=None as before.

Tests

tests/unit/test_push_context_cache.py (9 cases): first-request resolution counts, warm requests make no upstream calls, ttl = 0 forces refetch, g.user mutation does not poison the cache, logout eviction, and stale session eviction for both branches. Full suite: 238 passed.

Ruff (repo config) is clean on both touched files; the 3 remaining findings in auth/v1/__init__.py pre-exist on main (I001 import sort, ARG002 scope, F841 token).