fix(auth): stop IdP bearer defects from breaking authentication (LE-2099) (#14579)

Three defects found while testing the IdP support lane.

BUG-01 — revoking a role assignment left its provenance rows behind on
SQLite. ``authz_role_assignment_grant.assignment_id`` declares
``ondelete="CASCADE"``, but SQLite ignores foreign keys unless
``PRAGMA foreign_keys=ON`` is issued per connection, which Langflow never
does. Declaring the ORM relationship makes SQLAlchemy issue the child
deletes itself, so every delete path cascades identically on SQLite and
PostgreSQL. ``all, delete`` deliberately omits ``delete-orphan``: grant
rows are created by setting ``assignment_id`` directly, and
``delete-orphan`` would reject those as unparented at flush time.

BUG-03 — LE-2109 called for a short-lived cache so bearer-path group
reconciliation does not run on every request. It was never implemented,
so each authenticated request opened a transaction, took the
authorization plugin's policy locks and appended a
``directory_membership:reconcile`` audit row. One QA session left 183 of
them; a single page load produced 16. A reconciliation that verified the
stored state already matched the claim is now remembered for
``LANGFLOW_EXTERNAL_AUTH_GROUP_RECONCILE_INTERVAL_SECONDS`` (default 60,
0 disables), keyed by the exact directory state it verified, so any
change in the group set, claim state or resolved user still reconciles
immediately. A pass that changed something is not cached until a
confirming pass runs, so a pending post-commit propagation retry is never
hidden behind the cache.

BUG-02 (partial) — a deadlocked reconciliation was reported to the caller
as ``401 {"detail":"Token authentication failed"}``. A transaction rolled
back as a deadlock victim never judged the credential, so it is now
raised as ``AuthBackendUnavailableError`` and answered with a retryable
``503`` (``Retry-After: 1``) — ``1013`` on websockets — instead of
blaming a token that was never rejected. It also short-circuits the
remaining credential fallbacks rather than replaying them into the same
outage. The lock-ordering defect itself lives in the authorization plugin
and is fixed there.