perf(server): stop re-resolving the namespace on every authenticated request

[otavio]

What

Cuts identity resolution on an authenticated device-list request from five statements to
three, removes five namespaces scans per /stats call, and puts the systems singleton
behind the cache.

This branch applies directly on top of master — it is no longer stacked on #6888. It is a
single commit; the clock-pinning store tests are part of it, since they assert this change's
own switch from time.Now() to clock.Now().

Why

Part of shellhub-io/team#200. On the 58,670-device production instance the review measured,
a 2-row namespaces table took 1,371,078,783 sequential scans in 66 days, with
users and memberships at ~472 million each. The plans are correct — PostgreSQL should
seq-scan a 2-row table — so the cost is call volume, not query shape, and no index would
help.

Traced to source, one authenticated GET /api/devices spends five statements establishing
who is calling against two that answer the request:

1. Authenticator.Resolve → GetUserRole → NamespaceResolve, which carries
   Relation("Memberships.User") — bun issues the has-many as a second statement.
2. GetUserAdmin → UserResolve, a third, on users.
3. ListDevices then resolves the same namespace again, memberships included, purely to
   read two integers off it (HasMaxDevices / HasMaxDevicesReached).

That mechanism is why users and memberships sit at near-identical counts, and why
namespaces runs ahead of both — it is fetched twice per request.

Changes

• NamespaceGetDeviceLimit: reads the two columns the device-limit check needs. Kept
  additive on purpose — NamespaceResolve keeps its relation, so the ~40 sites in the
  cloud repo that read memberships off a resolved namespace are untouched. Dropping the
  relation from NamespaceResolve itself would have broken cloud at runtime, not at compile
  time.
• models.NamespaceDeviceLimit: the ceiling rule moves here;
  Namespace.HasMaxDevices/HasMaxDevicesReached delegate, so it stays defined once.
• authctx: the authenticator forwards the limit it already read, paired with the tenant
  it belongs to so a request targeting another namespace cannot be answered from it. The
  guard lives inside the accessor rather than at the call site, so a future caller cannot
  skip it. Falls back to the store when the request carries no limit — API keys, internal
  callers, the admin surface.
• GetUserRole deleted: it had become a one-line wrapper over ResolveNamespaceRole
  with a single caller.
• GetStats: its five counts bounded the namespace with
  namespace_id = (SELECT id FROM namespaces WHERE id = ?), one namespaces scan per stat,
  where every other scoped query in the store uses the shared scope option. They now do too.
• systems cache: one row, 10,401,522 sequential scans and zero index scans in
  the same window. The key gets a single definition in pkg/cache — it is spelled in three
  packages across two repositories, and a second literal would silently stop invalidating. It
  was already spelled twice, with nothing populating it.

Reviewer notes

Re-fetching per request stays deliberate. authn.go re-reads role and admin on every
request because shellhub-io/team#193 found a demoted admin keeping API access for up to 72
hours. This PR does not cache them; it removes the duplicate resolve in the handler. Any
future identity cache needs explicit invalidation on membership/role/user writes.

One error code changes. scope.NewBounded rejects only empty tenant IDs, so a bounded
scope can carry a malformed UUID. It used to reach PostgreSQL as SQLSTATE 22P02; the shared
scope option's guard now returns ErrNoDocuments, matching NamespaceResolve and the rest of
the store.

pinClock now lives in storetest/helpers.go. #6888 introduced the helper next to the
session-retention tests it was written for. This PR needs it and no longer sits on that
branch, so the helper moves to the shared helpers file. If #6888 rebases onto a master that
carries this PR, it must drop its own copy.

The systems cache does not help Enterprise or Cloud on its own — they serve /info
from their own service. shellhub-io/cloud#2491 covers that side, and must land
with this PR anyway: NamespaceGetDeviceLimit on the store interface requires cloud's
generated mock to be regenerated, or cloud's test build fails in eight packages.

Not in this PR, and deliberately so: caching identity resolution (needs its own design
against the #193 constraint), the unattributed sessions scans (blocked on
pg_stat_statements in #6886), the devices online count (moved to
shellhub-io/team#209), and the enterprise license evaluator's unbounded GetStats — split
out to shellhub-io/team#212 after it turned out to account for ~43% of the devices
sequential scans on that host.

Testing

server: full suite and golangci-lint clean; root pkg/models and pkg/cache clean.

Worth probing:

• TestGetStats already covers cross-tenant isolation on the rewritten counts, including the
  active-session count that reaches the namespace through devices — that one needed a table
  alias, and a wrong alias would silently widen the bound rather than error.
• TestSystemGet covers the subtle path: Cache.Get reports no error on a miss and
  leaves the destination zeroed, so the Setup && Authentication.Local != nil guard is the
  only thing standing between a miss and a zero-value response.
• TestGetStatsOnlineBoundary fails if buildOnlineDevicesQuery goes back to time.Now();
  verified by reverting it.