refactor(core): optimize performance, fix concurrency and clean up AGENTS.md design violations

- Concurrency: Added lock protection to WebSocket writes, fixed timer leaks, and prevented config cache listener context leaks.
- Performance: Added memory cache in ObservabilityBufferStore, periodic cleaning in CH Deduplicator, and buffered ZIP batch download writes.
- Design: Introduced Redis caching for OAuth session/tokens, sanitized raw DB error messages, segregated handlers and logics, and standard CAP response envelopes.

internal/apps/admin/user/logics.go

@@ -9,6 +9,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/Rain-kl/Wavelet/internal/apps/oauth"
+	"github.com/Rain-kl/Wavelet/internal/db"
 	"github.com/Rain-kl/Wavelet/internal/db/idgen"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/internal/repository"
@@ -35,7 +37,22 @@ func updateUserStatus(ctx context.Context, id uint64, active bool) error {
 	if !active && flags.IsAdmin {
 		return errors.New(cannotDisable)
 	}
-	return repository.UpdateUserActive(ctx, id, active)
+
+	var tokens []model.AccessToken
+	if !active {
+		_ = db.DB(ctx).Where("user_id = ?", id).Find(&tokens).Error
+	}
+
+	err = repository.UpdateUserActive(ctx, id, active)
+	if err == nil {
+		oauth.InvalidateCachedUser(ctx, id)
+		if !active {
+			for _, token := range tokens {
+				oauth.InvalidateCachedToken(ctx, token.TokenHash)
+			}
+		}
+	}
+	return err
 }
 
 func deleteUser(ctx context.Context, currentUserID, targetID uint64) error {
@@ -49,7 +66,18 @@ func deleteUser(ctx context.Context, currentUserID, targetID uint64) error {
 	if flags.IsAdmin {
 		return errors.New(cannotDelete)
 	}
-	return repository.DeleteUserWithRelations(ctx, targetID)
+
+	var tokens []model.AccessToken
+	_ = db.DB(ctx).Where("user_id = ?", targetID).Find(&tokens).Error
+
+	err = repository.DeleteUserWithRelations(ctx, targetID)
+	if err == nil {
+		oauth.InvalidateCachedUser(ctx, targetID)
+		for _, token := range tokens {
+			oauth.InvalidateCachedToken(ctx, token.TokenHash)
+		}
+	}
+	return err
 }
 
 func createUser(ctx context.Context, req createUserRequest) (model.User, error) {

internal/apps/admin/user/routers.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/Rain-kl/Wavelet/internal/apps/oauth"
 	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/Rain-kl/Wavelet/pkg/logger"
 	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
 
@@ -103,7 +104,8 @@ func abortUserLogicError(c *gin.Context, err error, notFoundMsg string, forbidde
 			return true
 		}
 	}
-	response.AbortInternal(c, msg)
+	logger.ErrorF(c.Request.Context(), "Admin user error: %v", err)
+	response.AbortInternal(c, "内部服务器错误")
 	return true
 }
 
@@ -129,7 +131,8 @@ func ListUsers(c *gin.Context) {
 
 	total, modelUsers, err := listUsers(c.Request.Context(), req)
 	if err != nil {
-		response.AbortInternal(c, err.Error())
+		logger.ErrorF(c.Request.Context(), "List admin users failed: %v", err)
+		response.AbortInternal(c, "获取用户列表失败")
 		return
 	}