perf(cache): 三层缓存框架补强

- 新增 cache-framework skill，规范 RAM→Redis→DB 读路径、失效与 pub/sub
- 上传元数据 Otter+Redis 缓存与多节点失效；Auth Source 缓存与 pub/sub
- ListSystemConfigsByKeys 补 Redis 层；上传统计单事务；登录/Token 缓存预热
- cleanup 任务补 upload meta 失效钩子

internal/repository/upload.go

@@ -65,7 +65,12 @@ func GetActiveUploadByID(ctx context.Context, id uint64) (model.Upload, error) {
 // SoftDeleteUpload marks an upload as deleted.
 // External modules must use upload.Remove or upload.RemoveOwned; only internal/apps/upload may call this.
 func SoftDeleteUpload(ctx context.Context, upload *model.Upload) error {
-	return db.DB(ctx).Model(upload).Update("status", model.UploadStatusDeleted).Error
+	return SoftDeleteUploadTx(db.DB(ctx), upload)
+}
+
+// SoftDeleteUploadTx marks an upload as deleted within an existing transaction.
+func SoftDeleteUploadTx(tx *gorm.DB, upload *model.Upload) error {
+	return tx.Model(upload).Update("status", model.UploadStatusDeleted).Error
 }
 
 // UpdateUpload applies partial field updates to an upload record.
@@ -100,7 +105,12 @@ func FindReusableUploadByHash(ctx context.Context, hash string, size int64) (mod
 // CreateUpload persists a new upload record.
 // External modules must use upload.Ingest; only internal/apps/upload may call this.
 func CreateUpload(ctx context.Context, upload *model.Upload) error {
-	return db.DB(ctx).Create(upload).Error
+	return CreateUploadTx(db.DB(ctx), upload)
+}
+
+// CreateUploadTx persists a new upload record within an existing transaction.
+func CreateUploadTx(tx *gorm.DB, upload *model.Upload) error {
+	return tx.Create(upload).Error
 }
 
 // ListUploadsByIDs returns active uploads matching the given IDs.