fix(auth): ValidateUserAPIKey fires unbounded go func() per request (DoS amplifier + log spam) #1027

Problem. service_apikeys.go:278-285 updates last-used in a go func() with context.Background() on every authenticated request — no concurrency bound, detached from request cancellation; a revoked-but-presented key logs "not found" on every request.

Evidence. service_apikeys.go:278-285. Report 03 (H2). Violates feedback_semaphore_at_api_call / feedback_ctx_cancel_terminal.

Impact. Resource exhaustion + log flooding on a security-critical path.

Suggested fix. Bound the work (single-flight / small worker pool / debounce to at most once per N seconds per key), or update synchronously with a short derived timeout. Demote "key not found" to debug + rate-limit.

References. Source: report 03 (H2). Related #672/PR #859 (recover() in fire-and-forget goroutines — complementary, not the same fix).

Filed from automated adversarial code review (see docs/code-review/). Source finding(s): 03-H2.