#539 [API/Perf] rbac.py N+1 DB queries - no permission cache

File: api/middleware/rbac.py:659-661. Every permission check opens new DB connection and creates new auth_client session. On 10000 requests/minute, this creates 10000+ DB round-trips just for RBAC. IMPACT: Severe database pressure. FIX: Add request-scoped permission cache using ContextVar.