fix(auth): add Close() to RBACManager and bound permission caches (#295, #296)

[xe-nvdk]

Summary

• high(auth): RBACManager goroutine leak — no Close() method #295: cacheCleanupLoop goroutine ran forever with no shutdown mechanism. Added done channel + Close() method following the AuthManager pattern. Registered with shutdown coordinator at PriorityAuth.
• high(auth): RBAC permission caches grow unbounded #296: Both tokenCache and permCache had no max size — only TTL-based expiration. Added configurable MaxCacheSize (default 10,000 entries per cache) with random eviction on insertion when exceeded.

Test plan

• go build ./cmd/... ./internal/... passes
• go test ./internal/auth/... passes
• Post-implementation security review: RBAC is license-gated, no race conditions in Close(), eviction is safe (re-checks hit database)

Closes #295
Closes #296

[gemini-code-assist]

Code Review

This pull request fixes a goroutine leak in RBACManager by adding a Close method and a shutdown signal, and prevents unbounded memory growth by implementing a maximum cache size with random eviction. Feedback was provided to extract the duplicated eviction logic into a reusable helper method to improve code maintainability.

[gemini-code-assist]

This cache eviction logic is duplicated in CheckPermissionsBatch (lines 1059-1064) and for tokenCache in getTokenRBACData (lines 1142-1147). To improve maintainability and reduce code duplication, consider extracting this logic into a private helper method. This would centralize the eviction strategy, making future modifications (e.g., switching to an LRU policy) much simpler.