Bound JWT token cache and document auth model

The per-handler JWT validation cache was never pruned, so a long-running
process accumulated one map entry per distinct rotating token, growing
without bound (a slow memory leak / DoS vector). Evict stale entries on
the cache-miss path and cap the cache at maxTokenCacheSize, clearing it
if eviction of expired tokens cannot free space.

Also document in the README that auth verifies only the token signature
and expiry (claims/roles are not enforced) and that an empty
jwt-public-key disables authentication entirely.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/api/authentication.go

@@ -15,6 +15,10 @@ import (
 	"github.com/golang-jwt/jwt/v4"
 )
 
+// maxTokenCacheSize bounds the number of validated tokens kept in memory.
+// Reaching it triggers eviction of expired entries (see authHandler).
+const maxTokenCacheSize = 1024
+
 func authHandler(next http.Handler, publicKey ed25519.PublicKey) http.Handler {
 	cacheLock := sync.RWMutex{}
 	cache := map[string]*jwt.Token{}
@@ -34,6 +38,13 @@ func authHandler(next http.Handler, publicKey ed25519.PublicKey) http.Handler {
 			next.ServeHTTP(rw, r)
 			return
 		}
+		if ok {
+			// Cached token has since expired (or become otherwise invalid);
+			// drop it so the cache does not accumulate stale entries.
+			cacheLock.Lock()
+			delete(cache, rawtoken)
+			cacheLock.Unlock()
+		}
 
 		// The actual token is ignored for now.
 		// In case expiration and so on are specified, the Parse function
@@ -52,6 +63,21 @@ func authHandler(next http.Handler, publicKey ed25519.PublicKey) http.Handler {
 		}
 
 		cacheLock.Lock()
+		// Bound the cache: cc-backend mints short-lived, rotating tokens, so
+		// without an upper limit the map would grow unbounded over the
+		// lifetime of the process. When the cap is reached, evict any entries
+		// that have expired; if none have, clear the cache entirely rather
+		// than letting it grow without bound.
+		if len(cache) >= maxTokenCacheSize {
+			for k, t := range cache {
+				if t.Claims.Valid() != nil {
+					delete(cache, k)
+				}
+			}
+			if len(cache) >= maxTokenCacheSize {
+				clear(cache)
+			}
+		}
 		cache[rawtoken] = token
 		cacheLock.Unlock()