perf(cap): add runtime settings snapshot for dynamic config

Replace per-request GetByKey calls with a singleflight-backed
RuntimeSettings snapshot loaded via ListSystemConfigsByKeys.
Invalidate snapshot on admin cap_* writes and via Redis pub/sub.
Simplify VerifyMiddleware and update PERFORMANCE.md status.

internal/testhelper/cleanup.go

@@ -0,0 +1,17 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package testhelper
+
+// RegisterCleanup registers an extra cleanup hook invoked by SetupTestEnvironment.
+func RegisterCleanup(fn func()) {
+	extraCleanups = append(extraCleanups, fn)
+}
+
+var extraCleanups []func()
+
+func runExtraCleanups() {
+	for _, fn := range extraCleanups {
+		fn()
+	}
+}

internal/testhelper/test_helper.go

@@ -75,6 +75,7 @@ func SetupTestEnvironment(t *testing.T) (*gorm.DB, *miniredis.Miniredis, func())
 
 	// Cleanup function
 	cleanup := func() {
+		runExtraCleanups()
 		model.ResetSystemConfigRAMCacheForTest()
 		_ = redisClient.Close()
 		mr.Close()