perf(cache): 三层缓存框架补强

- 新增 cache-framework skill，规范 RAM→Redis→DB 读路径、失效与 pub/sub
- 上传元数据 Otter+Redis 缓存与多节点失效；Auth Source 缓存与 pub/sub
- ListSystemConfigsByKeys 补 Redis 层；上传统计单事务；登录/Token 缓存预热
- cleanup 任务补 upload meta 失效钩子

internal/apps/upload/ingest/helpers.go

@@ -11,9 +11,11 @@ import (
 	"strings"
 	"time"
 
+	uploadcache "github.com/Rain-kl/Wavelet/internal/apps/upload/cache"
 	"github.com/Rain-kl/Wavelet/internal/apps/upload/shared"
 	uploadstats "github.com/Rain-kl/Wavelet/internal/apps/upload/stats"
 	uploadstorage "github.com/Rain-kl/Wavelet/internal/apps/upload/storage"
+	"github.com/Rain-kl/Wavelet/internal/db"
 	"github.com/Rain-kl/Wavelet/internal/db/idgen"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/internal/repository"
@@ -99,7 +101,7 @@ func storeObject(ctx context.Context, objectKey string, reader io.Reader, size i
 }
 
 func persistUploadRecord(ctx context.Context, upload *model.Upload, objectKey string) error {
-	if err := repository.CreateUpload(ctx, upload); err != nil {
+	if err := createUploadWithStats(ctx, upload); err != nil {
 		_, backend, backendErr := storage.Active(ctx)
 		if backendErr == nil {
 			if deleteErr := backend.Delete(ctx, objectKey); deleteErr != nil {
@@ -108,10 +110,19 @@ func persistUploadRecord(ctx context.Context, upload *model.Upload, objectKey st
 		}
 		return err
 	}
-	uploadstats.RecordUploadStatsAdd(ctx, upload)
+	uploadcache.SetUploadMetaCache(ctx, upload)
 	return nil
 }
 
+func createUploadWithStats(ctx context.Context, upload *model.Upload) error {
+	return db.DB(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := repository.CreateUploadTx(tx, upload); err != nil {
+			return err
+		}
+		return uploadstats.ApplyUploadStatsDeltaTx(tx, upload, 1)
+	})
+}
+
 func createDedupRecord(ctx context.Context, existing model.Upload, req Request) (Result, error) {
 	accessMode := resolveAccessMode(req.Type, req.AccessMode)
 	newUpload := model.Upload{

internal/apps/upload/ingest/ingest_test.go

@@ -183,6 +183,52 @@ func TestIngestPolicyDedupNewRecordCreatesSecondRecord(t *testing.T) {
 	}
 }
 
+func TestCreateUploadWithStatsRollsBackOnCreateFailure(t *testing.T) {
+	dbConn, _, cleanup := testhelper.SetupTestEnvironment(t)
+	defer cleanup()
+	ctx := context.Background()
+
+	existing := model.Upload{
+		ID:        99001,
+		UserID:    1001,
+		FileName:  "existing.png",
+		FilePath:  "uploads/existing.png",
+		FileSize:  64,
+		MimeType:  "image/png",
+		Extension: "png",
+		Type:      "generic",
+		Status:    model.UploadStatusUsed,
+		CreatedAt: time.Now(),
+	}
+	if err := dbConn.Create(&existing).Error; err != nil {
+		t.Fatalf("seed upload failed: %v", err)
+	}
+
+	duplicate := &model.Upload{
+		ID:        existing.ID,
+		UserID:    1002,
+		FileName:  "duplicate.png",
+		FilePath:  "uploads/duplicate.png",
+		FileSize:  128,
+		MimeType:  "image/png",
+		Extension: "png",
+		Type:      "generic",
+		Status:    model.UploadStatusUsed,
+		CreatedAt: time.Now(),
+	}
+	if err := createUploadWithStats(ctx, duplicate); err == nil {
+		t.Fatal("createUploadWithStats with duplicate ID expected error")
+	}
+
+	stats, err := loadTotalStats(ctx)
+	if err != nil {
+		t.Fatalf("loadTotalStats returned error: %v", err)
+	}
+	if stats.TotalCount != 0 || stats.TotalSize != 0 {
+		t.Fatalf("loadTotalStats() = count %d size %d, want zero after rolled-back stats", stats.TotalCount, stats.TotalSize)
+	}
+}
+
 func TestRemoveDecrementsStats(t *testing.T) {
 	_, _, cleanup := testhelper.SetupTestEnvironment(t)
 	defer cleanup()

internal/apps/upload/ingest/remove.go

@@ -6,9 +6,12 @@ package ingest
 import (
 	"context"
 
+	uploadcache "github.com/Rain-kl/Wavelet/internal/apps/upload/cache"
 	uploadstats "github.com/Rain-kl/Wavelet/internal/apps/upload/stats"
+	"github.com/Rain-kl/Wavelet/internal/db"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/internal/repository"
+	"gorm.io/gorm"
 )
 
 // Remove soft-deletes an upload and decrements incremental stats.
@@ -17,8 +20,7 @@ func Remove(ctx context.Context, uploadID uint64) (model.Upload, error) {
 	if err != nil {
 		return model.Upload{}, err
 	}
-	uploadstats.RecordUploadStatsRemove(ctx, &upload)
-	if err := repository.SoftDeleteUpload(ctx, &upload); err != nil {
+	if err := softDeleteUploadWithStats(ctx, &upload); err != nil {
 		return model.Upload{}, err
 	}
 	upload.Status = model.UploadStatusDeleted
@@ -34,10 +36,23 @@ func RemoveOwned(ctx context.Context, userID, uploadID uint64) (model.Upload, er
 	if upload.UserID != userID {
 		return model.Upload{}, ErrForbidden
 	}
-	uploadstats.RecordUploadStatsRemove(ctx, &upload)
-	if err := repository.SoftDeleteUpload(ctx, &upload); err != nil {
+	if err := softDeleteUploadWithStats(ctx, &upload); err != nil {
 		return model.Upload{}, err
 	}
 	upload.Status = model.UploadStatusDeleted
 	return upload, nil
 }
+
+func softDeleteUploadWithStats(ctx context.Context, upload *model.Upload) error {
+	statsSnapshot := *upload
+	if err := db.DB(ctx).Transaction(func(tx *gorm.DB) error {
+		if err := repository.SoftDeleteUploadTx(tx, upload); err != nil {
+			return err
+		}
+		return uploadstats.ApplyUploadStatsDeltaTx(tx, &statsSnapshot, -1)
+	}); err != nil {
+		return err
+	}
+	uploadcache.InvalidateUploadMetaCache(ctx, upload.ID)
+	return nil
+}