Authorization staleness and revocation

Edge KV puts the permission check an hour behind the Postgres row

The Worker in this FastAPI pattern authorizes requests itself from a KV copy of the session, so a role change lands only when the origin's invalidation write does, and the 3600-second cap is the only other bound.