perf: cache authorized-group delegation lookups

[solracsf]

Summary

Repeated group-backend and DB queries on every #[AuthorizedAdminSetting] request, every share formatting call, and every group-membership hook are replaced by scoped caches (per-request arrays, a two-tier local+distributed cache, and a per-instance memoization property). All four write paths on authorized_groups invalidate the cache through AuthorizedGroupService, which now batches N mutations into a single clearCache() call.

A UNIQUE constraint on group_id is added via migration, closing a concurrent-write race that the previous applicative pre-check could not cover. Duplicate rows on existing instances are cleaned up in preSchemaChange() before the index is created.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

AI (if applicable)

• The content of this PR was partly or fully generated using AI