perf: caching, batched DM resolution, bounded audit, global kind index

[tlongwell-block]

Summary

Performance improvements from staging profiling (2026-04-17). All findings from the profiling plan are addressed — Phases 1 through 3.

Projected impact:

• GET /api/channels: 329ms → ~35ms (batch DM resolution)
• Per-request DB queries: ~43 → ~5
• channels seq scans: >50% reduction
• Global fan-out: O(all_subs) → O(matching_kind_subs)
• DB connections held: 57/100 → ~22/100 (room for 4 relay pods)

Changes

Caching (#1, #2)

• Wire membership_cache (moka, 10s TTL, 10k cap) into all 10 is_member() call sites with cache-aside pattern.
• Add accessible_channels_cache for get_accessible_channel_ids() at 3 call sites (REQ handler, /api/feed, /api/search).
• Invalidate on all mutation paths: add_member, remove_member, channel create/delete, DM create/expand, compensation delete, audio auto-join.
• Multi-pod: other pods rely on TTL expiry (documented in code).

Batch DM resolution (#3)

• Add get_members_bulk(channel_ids) using WHERE channel_id = ANY($1).
• Rewrite /api/channels to resolve all DM participants in 2 queries (one get_members_bulk + one get_users_bulk) instead of 2×N_DMs.
• Remove per-DM resolve_dm_participants() function.

Bounded audit (#7)

• Replace unbounded tokio::spawn(audit.log()) with bounded mpsc channel (capacity 1000) + single worker task.
• Uses .send().await for backpressure — audit entries must not be silently dropped (SOX-grade tamper-evident chain).
• Migrate media upload audit from unbounded spawn to audit_tx too.
• Add sprout_audit_log_errors_total counter for DB write failures.

Graceful audit drain on shutdown

• AppState::new() returns (Self, AuditShutdownHandle) so the caller can drain the audit queue during graceful shutdown.
• AuditShutdownHandle owns a CancellationToken + JoinHandle. On drain: cancel fires → worker calls audit_rx.close() (atomically rejects future sends) → drains buffered entries via recv().await → exits.
• Independent of Arc<AppState> lifetime — works even when background tasks (reaper, pubsub, health server) still hold state clones.
• 5-second timeout prevents hanging on a stuck audit DB.
• Extracted log_audit_entry() helper shared by normal loop and drain loop.

Global kind index (#6)

• Add global_kind_index and global_wildcard_index to SubscriptionRegistry for sub-linear fan-out on global events.
• Preserves channel/global scoping invariant (no behavior change).
• 4 new tests: kind routing, wildcard routing, removal cleanup, channel/global isolation.

Pool sizing (#8)

• Main pool: max 50→20, min 5→2. Audit pool: max=5, min=1.
• Evidence: staging measured 51 idle + 1 active out of 50 — most connections sat unused.

Observability (#9)

• Wire sprout_fanout_recipients histogram at all 4 fan_out() sites.

Testing

• 209 unit tests pass (205 existing + 4 new global index tests)
• cargo clippy clean, cargo fmt clean
• Crossfire reviewed by codex CLI and opus subagent. Audit drain went through 3 rounds of codex review (4/10 → 6/10 → 9/10) fixing Arc lifetime and late-send race issues.

What's NOT in this PR

• PG config tuning (docs(readme): clarify desktop setup #4) — infrastructure, applied at runtime
• Redis config hardening (Initial backend revisions, workflow expansion #5) — infrastructure, applied at runtime
• Multi-pod cache invalidation — future work when CNPG/PgBouncer is deployed