Server session cache

Server requests use the signed Session snapshot for up to 60 seconds, avoiding one session statement on a todo.list cache hit. The scenario B latency change was within local noise. Revocation on another device can take up to a minute for ordinary data. Membership removal remains immediate. Webhook endpoint changes and OAuth connection revocation read the current database session. The files gateway reads the membership directly. See Session reads and PR #195.