perf(cache): 三层缓存框架补强

- 新增 cache-framework skill，规范 RAM→Redis→DB 读路径、失效与 pub/sub
- 上传元数据 Otter+Redis 缓存与多节点失效；Auth Source 缓存与 pub/sub
- ListSystemConfigsByKeys 补 Redis 层；上传统计单事务；登录/Token 缓存预热
- cleanup 任务补 upload meta 失效钩子

internal/apps/admin/auth_source/routers.go

@@ -13,6 +13,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/apps/admin"
 	"github.com/Rain-kl/Wavelet/internal/apps/oauth"
 	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/Rain-kl/Wavelet/internal/repository"
 	"github.com/gin-gonic/gin"
 
 	"github.com/Rain-kl/Wavelet/internal/common/response"
@@ -91,6 +92,7 @@ func CreateAuthSource(c *gin.Context) {
 		response.AbortBadRequest(c, err.Error())
 		return
 	}
+	_ = repository.InvalidateAuthSourceCache(c.Request.Context())
 	source.Sanitize()
 	c.JSON(http.StatusOK, response.OK(source))
 }
@@ -150,6 +152,7 @@ func UpdateAuthSource(c *gin.Context) {
 		oauth.InvalidateOIDCProviderCache(normalizeIssuer(existing.OpenIDDiscoveryURL))
 	}
 	oauth.InvalidateOIDCProviderCache(normalizeIssuer(req.OpenIDDiscoveryURL))
+	_ = repository.InvalidateAuthSourceCache(c.Request.Context())
 
 	updated, err := model.GetAuthSourceByID(c.Request.Context(), id)
 	if err != nil {
@@ -191,6 +194,7 @@ func ToggleAuthSource(c *gin.Context) {
 		response.AbortBadRequest(c, err.Error())
 		return
 	}
+	_ = repository.InvalidateAuthSourceCache(c.Request.Context())
 	c.JSON(http.StatusOK, response.OKNil())
 }
 
@@ -216,6 +220,7 @@ func DeleteAuthSource(c *gin.Context) {
 		response.AbortBadRequest(c, err.Error())
 		return
 	}
+	_ = repository.InvalidateAuthSourceCache(c.Request.Context())
 	c.JSON(http.StatusOK, response.OKNil())
 }