perf: configurable guest-user + nav-tree cache TTLs (longer defaults) to let Aurora idle under scrapes

[jee7s]

Why

Targets fix/session-store-cleanup-interval. That branch lets the wiki's DB connections drain so Aurora Serverless v2 can auto-pause when idle. But two periodic DB reads still fire on anonymous / crawler page views — and both are shorter than the 8-min pause window, so a search-engine scrape keeps the cluster awake (and billing ACUs):

Periodic DB read	Was	Now (default)
Guest user reload (getGuestUser, auth.js)	every 1 min (hardcoded)	1 hour
Sidebar nav tree (getTree, navigation.js)	300s / 5 min	1 hour

With both at 1h (≫ the 8-min pause window), they no longer pin the DB awake under sustained anonymous traffic — the DB can idle/pause between refreshes. Cuts guest-reload queries ~60× and nav queries ~12× on scrape traffic.

(Page content is already DB-free on repeat hits via the existing disk page cache; the remaining scrape→DB drivers were these two periodic refreshes — this closes them.)

Changes

• auth.js: guest cacheExpiration now plus({ seconds: WIKI.config.auth.guestCacheTTL }) instead of a hardcoded 1 minute.
• navigation.js: nav cache TTL now WIKI.config.nav.cacheTTL instead of 300.
• Config wiring in the established pattern: defaults in server/app/data.yml (auth.guestCacheTTL: 3600, nav.cacheTTL: 3600), env mapping in dev/build/config.yml (AUTH_GUEST_CACHE_TTL, NAV_CACHE_TTL), docs in config.sample.yml.

Correctness

• Guest perms still update immediately: an admin changing group permissions calls flushGuestUser (sets cacheExpiration to the past), forcing a reload regardless of TTL.
• Nav edits: appear within the TTL, and the existing admin Flush Cache clears nav:sidebar:* on demand.
• Defaults are conservative (1h); set the env vars lower if you need fresher nav/permissions.

Note (multi-instance)

These caches are per-process; before running wiki at >1 task, back them with Redis / broadcast invalidation (out of scope here, single-task today).

🤖 Generated with Claude Code