Cache Arc<TokenClaims> in JWT validation; bump Docker base images

JWT validation cache now stores Arc<TokenClaims> and validate_token
returns Arc<TokenClaims>. On a cache hit — the 99% path for every
authenticated request — the moka lookup was deep-cloning the whole
claims struct (5 Strings: sub, jti, username, email, role) on every
call. It is now a refcount bump. Read-only callers (admin middleware)
go through Deref and allocate nothing; the auth middleware clones only
the three fields it moves into CurrentUser (was 5 clones, now 3), and
the admin paths clone only role (was 5, now 1). A new test asserts the
hit path returns a pointer-equal Arc.

TokenServicePort::validate_token is the single trait method touched;
its only implementor is JwtTokenService and the only production callers
are the auth and admin middleware (the WOPI handler uses a separate
WopiTokenService).

Dockerfile: rust:1.94.1-alpine3.23 -> rust:1.96-alpine3.24 and
alpine:3.23.3 -> alpine:3.24.0 for the runtime stage.

https://claude.ai/code/session_0193Hff42gaA962wThxMGSd1

Dockerfile

@@ -1,5 +1,5 @@
 # ─── Stage 1: Shared build base (avoids duplicate apk install) ────────────────
-FROM rust:1.94.1-alpine3.23 AS base
+FROM rust:1.96-alpine3.24 AS base
 # sqlx's postgres driver speaks the wire protocol in pure Rust (no pq-sys in
 # Cargo.lock) and TLS goes through rustls, so libpq headers are never needed at
 # build time. perl/make/gcc/musl-dev remain for the C builds of aws-lc-sys.
@@ -41,7 +41,7 @@ ARG DATABASE_URL="postgres://postgres:postgres@localhost/oxicloud"
 RUN DATABASE_URL="${DATABASE_URL}" cargo build --release
 
 # ─── Stage 4: Minimal runtime image ──────────────────────────────────────────
-FROM alpine:3.23.3
+FROM alpine:3.24.0
 
 # OCI image metadata
 LABEL org.opencontainers.image.title="OxiCloud" \