[Performance] Batch reauthorize persisted post-Ask evidence without N+1 queries

[seonghobae]

Buyer impact

Reading a post with many persisted Ask exchanges currently reauthorizes each exchange serially. Correctness and fail-closed behavior are preserved, but database round-trips grow linearly with exchange count and can make the post detail visibly slower.

Current authority boundary

• Keep current tenant ABAC, publication eligibility, and each exchange's persisted knowledge cutoff.
• If any citation for an exchange is no longer visible, withhold that exchange exactly as today.
• Do not reuse stale authorization or expose hidden citation labels, counts, project links, or prose.
• Do not replace the canonical Project-history API or TEPP adapter.

Required implementation

1. Add a bounded repository function that accepts all persisted exchange citation sets and cutoffs for one post.
2. Validate citation UUIDs before SQL.
3. Fetch the authorized citation/project evidence in one bounded query or a fixed small number of queries.
4. Partition the result back to each exchange deterministically.
5. Preserve current response ordering and fail-closed removal semantics.
6. Add a maximum exchange/citation budget and explicit truncation or typed failure rather than an unbounded IN list.
7. Record query-count and latency evidence in docs/product-technical-gap-baseline.md.

TDD acceptance

• 1, 10, and maximum supported exchange histories produce identical authorized responses to the current implementation;
• a hidden citation removes only the affected exchange and leaks no title, count, project key, or answer text;
• mixed knowledge cutoffs cannot admit evidence newer than each exchange's own cutoff;
• query count remains bounded independently of exchange count;
• real PostgreSQL integration, tenant isolation, statement/branch coverage, docstrings, and full API regressions pass;
• no feature or Buyer evidence surface is removed.

Origin

Tracked from the exact-head review of PR #342. The current implementation remains correct; this issue owns the bounded performance improvement so the security repair is not diluted by an unrelated query refactor.

[seonghobae]

Implementation exists in stacked PR #401 and was reconciled through #402 and #406, with the documented bounded-query and real-PostgreSQL evidence. Those merges target non-main stack branches; protected main exact head ef6f5a5 does not contain their merge commits. Keeping this issue open until the stack reaches protected main and the main-bound exact-head checks revalidate the acceptance contract.

[seonghobae]

Protected main at 7403a452 does not contain the project-history Ask reauthorization path that produced this N+1 issue: backend/app/ask_project_history.py, account/post Ask sessions, per-exchange knowledge cutoffs, and the serial reauthorization loop are absent. The earlier implementation exists only in non-default stacked merges #401/#402/#406 and cannot transfer protected delivery evidence. PR #631 records ADR 0136 as a broader missing current-main product contract and requires bounded batch reauthorization before that UI is introduced. Closing this obsolete symptom ticket prevents implementing an optimizer for an unshipped path; a current-main ADR 0136 slice must carry its own query-count and tenant-isolation acceptance.