Hardened search auth caching and CI gates

Bounded the search auth cache and added CI gates that fail PR validation if the cache TTL or invalidation path regresses. Closes a class of issues that had been intermittently 401-ing the search surface.