fix(auth): debounce team_api_keys.last_used to one write per key per minute

[ValentaTomas]

Summary

UpdateLastTimeUsed fires on every authenticated request and is one of the largest sources of dead-tuple churn on team_api_keys, for a column that is minute-grade observability metadata. An in-process per-key debounce (60s window) keeps last_used fresh to the minute while removing almost all of that write load; with multiple auth replicas the worst case is one write per key per replica per minute.

[cursor]

PR Summary

Low Risk
Behavior change is limited to throttling observability metadata writes; auth and authorization paths are unchanged aside from fewer background DB updates.

Overview
Authenticated API key lookups no longer trigger a team_api_keys.last_used update on every request. A per-process, per-key 60-second debounce decides whether to run the existing async UpdateLastTimeUsed call, with compare-and-swap so concurrent requests after the window still produce only one write, and occasional map sweeps so idle keys do not grow memory forever. last_used stays accurate to about a minute; with multiple auth replicas the upper bound is roughly one write per key per replica per minute. Unit tests cover window suppression, key independence, and concurrent single-winner behavior.

^{Reviewed by Cursor Bugbot for commit 7c37367. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ValentaTomas]

closing for now, will revisit