[2.x] perf: eliminate redundant DB writes in auth middleware and cache notification counts

[imorland]

Ports the performance improvements from #4365 (1.x) to 2.x, adapting for API changes in 2.x.

Changes

AccessToken::touch()

Only update last_ip_address / last_user_agent when the values have actually changed, and only call save() when the model is dirty. On high-traffic sites this eliminates a DB write on every token touch when last_activity_at has not yet elapsed the update threshold.

AuthenticateWithHeader / AuthenticateWithSession

Guard $actor->save() with isDirty() after updateLastSeen(). Since updateLastSeen() is throttled to 180 seconds, requests within that window were previously triggering an unconditional DB write even when nothing changed.

Notification count caching

Cache getUnreadNotificationCount() and getNewNotificationCount() for 5 minutes with active invalidation on all write paths. The TTL is a safety net; the cache is eagerly invalidated whenever:

• Notification::notify() creates new notifications for recipients
• ReadNotificationHandler marks a notification read
• ReadAllNotificationsHandler marks all notifications read
• NotificationResource (index) updates read_notifications_at via markNotificationsAsRead()

For ReadAllNotificationsHandler and ReadNotificationHandler, CacheRepository is injected via the constructor for testability rather than using resolve().

ApplicationInfoProvider::identifyDatabaseVersion()

Cache the DB version query for 24 hours. $this->cache (CacheRepository) is already injected into the class. In 2.x the query uses a match expression for SQLite vs MySQL/MariaDB/PostgreSQL, which is preserved inside the closure.

2.x adaptations

• ListNotificationsController no longer exists; its markNotificationsAsRead() call is now in NotificationResource's Index endpoint before() hook — cache invalidation added there
• identifyDatabaseVersion() in 2.x uses a match expression (handles SQLite separately); both branches are wrapped in the cache closure