Evict the oldest token instead of clearing the whole token cache

[HMarzban]

Problem

The token cache drops every entry the moment it fills: if (tokenCache.size >= MAX_TOKEN_CACHE) tokenCache.clear() (apps/hocuspocus.server/src/lib/auth.ts:60), with const MAX_TOKEN_CACHE = 1000 (apps/hocuspocus.server/src/lib/auth.ts:56).

Past 1000 distinct tokens, every signed-in person loses their cached verification at the same instant. Each one then pays a fresh Supabase Auth round trip on the next request or WebSocket handshake.

A reconnect storm turns that into a burst against Supabase Auth, and connecting gets slower for everyone at once.

What to do

Evict the oldest entry instead of clearing. A Map keeps insertion order, so the first key is the oldest.

Copy the shape already used for the document structure cache (apps/hocuspocus.server/src/api/services/adminStaleDocuments.service.ts:350-352).

Acceptance

• After 1001 distinct tokens, verifying the first token again calls Supabase Auth a second time.
• After 1001 distinct tokens, verifying the second token again is still served from the cache.

Notes

The cache and its setter are module-private, so size is not observable from outside. Check the two boxes by counting calls to the injected getUser. The suite in apps/hocuspocus.server/src/lib/__tests__/auth.test.ts already uses that option.