Cache Arc<TokenClaims> in JWT validation; bump Docker base images

JWT validation cache now stores Arc<TokenClaims> and validate_token
returns Arc<TokenClaims>. On a cache hit — the 99% path for every
authenticated request — the moka lookup was deep-cloning the whole
claims struct (5 Strings: sub, jti, username, email, role) on every
call. It is now a refcount bump. Read-only callers (admin middleware)
go through Deref and allocate nothing; the auth middleware clones only
the three fields it moves into CurrentUser (was 5 clones, now 3), and
the admin paths clone only role (was 5, now 1). A new test asserts the
hit path returns a pointer-equal Arc.

TokenServicePort::validate_token is the single trait method touched;
its only implementor is JwtTokenService and the only production callers
are the auth and admin middleware (the WOPI handler uses a separate
WopiTokenService).

Dockerfile: rust:1.94.1-alpine3.23 -> rust:1.96-alpine3.24 and
alpine:3.23.3 -> alpine:3.24.0 for the runtime stage.

https://claude.ai/code/session_0193Hff42gaA962wThxMGSd1

src/interfaces/middleware/admin.rs

@@ -54,7 +54,7 @@ pub async fn require_admin(
     Ok((
         Uuid::parse_str(&claims.sub)
             .map_err(|_| AppError::internal_error("Invalid user ID in token"))?,
-        claims.role,
+        claims.role.clone(),
     ))
 }
 
@@ -87,6 +87,6 @@ pub async fn require_authenticated(
     Ok((
         Uuid::parse_str(&claims.sub)
             .map_err(|_| AppError::internal_error("Invalid user ID in token"))?,
-        claims.role,
+        claims.role.clone(),
     ))
 }

src/interfaces/middleware/auth.rs

@@ -183,9 +183,9 @@ pub async fn auth_middleware(
                             })?;
                             let current_user = Arc::new(CurrentUser {
                                 id: user_id,
-                                username: claims.username,
-                                email: claims.email,
-                                role: claims.role,
+                                username: claims.username.clone(),
+                                email: claims.email.clone(),
+                                role: claims.role.clone(),
                             });
                             request.extensions_mut().insert(current_user);
                             tracing::Span::current().record("user_id", user_id.to_string());
@@ -287,9 +287,9 @@ pub async fn auth_middleware(
                         })?;
                         let current_user = Arc::new(CurrentUser {
                             id: user_id,
-                            username: claims.username,
-                            email: claims.email,
-                            role: claims.role,
+                            username: claims.username.clone(),
+                            email: claims.email.clone(),
+                            role: claims.role.clone(),
                         });
                         request.extensions_mut().insert(current_user);
                         request.extensions_mut().insert(CookieAuthenticated);