Fixed whole-cache clear on routine User/Admin saves - fixes #1270

[philayres]

Problem

On production, browsers were refetching /pages/<token>/template more often than expected within the same session, even though no app configuration had changed.

Root cause (confirmed via production logs): User and Admin both include AdminHandler, whose after_save :invalidate_cache called Rails.cache.clear unconditionally. Since User/Admin records are saved on nearly every request (Devise trackable sign-in tracking, lockable failed-attempt counters, app-type switching), this wiped the entire shared memcached on routine activity, destroying Application.server_cache_version and forcing a new template_version token for all users.

partial_cache_key in ApplicationHelper also embedded u&.updated_at, so any user-record save changed the cache key even when nothing relevant (roles/app type/access) had actually changed — e.g. switching app type A→B→A produced a different key than the original A session.

Fix

• AdminHandler#invalidate_cache now always resets the latest_update memo, but only calls Rails.cache.clear when the new clear_rails_cache_on_save? predicate (default true) returns true.
• User and Admin each override clear_rails_cache_on_save? to only clear the cache when the disabled flag actually changes (saved_change_to_disabled?). All other AdminHandler models keep clearing on every save.
• Removed the u&.updated_at segment from partial_cache_key, since role/app-type/access changes are already covered by other segments in the key.

Testing

• New spec: spec/models/concerns/admin_handler_cache_invalidation_spec.rb - covers User/Admin cache-clear scoping and confirms other AdminHandler models are unaffected.
• Extended spec/helpers/application_helper_spec.rb with #partial_cache_key coverage - key stability across irrelevant user saves, and correct invalidation on app-type change.
• Verified no regressions in related specs: admin/app_types_controller_spec.rb, pages_controller_spec.rb, reports_table_helper_spec.rb, admin_helper_spec.rb, handlebars_precompiler_helper_spec.rb.
• Verified real login/2FA/disabled-account flow: spec/system/user/user_spec.rb.
• Verified handlebars template/memcached recovery still works: spec/system/memcached_clear_template_recovery_spec.rb.

fixes #1270